Regular Expression Denial-of-Service in npm schema-inspector

Description

What kind of vulnerability is it? Who is impacted? Email address validation is vulnerable to a denial-of-service attack where some input (for example a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.) will freeze the program or web browser page executing the code.

Recommendation

Update the schema-inspector package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-f38p-c2gq-4pmr
• www.npmjs.com
• security.netapp.com
• CVE-2021-21267
• CWE-20
• CWE-400
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• MooTools Regular Expression Denial of Service - CVE-2021-32821
• Regular Expression Denial of Service (ReDoS) (GHSA-vx3p-948g-6vhq) - CVE-2021-27290
• jspdf vulnerable to Regular Expression Denial of Service (ReDoS) - CVE-2021-23353
• Regular expression denial of service in jquery-validation (GHSA-j9m2-h2pv-wvph) - CVE-2021-43306

Tags:

npm

schema-inspector