VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 5, 2020· Updated Sep 17, 2024

Regular Expression Denial of Service (ReDoS)

CVE-2020-7761

Description

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The @absolunet/kafe package before 3.2.10 is vulnerable to ReDoS via crafted invalid emails, causing denial of service.

Vulnerability

Overview The vulnerability in the @absolunet/kafe package before version 3.2.10 is a Regular Expression Denial of Service (ReDoS) flaw. The package's email validation function uses a regular expression that can be forced into catastrophic backtracking when processing specially crafted invalid email strings [1][2]. This causes the application to consume excessive CPU time, leading to a denial of service.

Exploitation

Conditions An attacker can exploit this vulnerability by sending a payload consisting of a long, crafted string that triggers the regex engine's exponential time complexity. No authentication is required if the email validation is performed on user-supplied input, such as in a registration form or contact form. The attack can be launched remotely over the network [2].

Impact

Successful exploitation results in the application becoming unresponsive or crashing, denying service to legitimate users. The impact is limited to availability; confidentiality and integrity are not directly affected.

Mitigation

The issue is fixed in version 3.2.10 of the package. Users should upgrade to this version or later. As of the publication date, no workarounds are documented [1].

References
  1. NVD - CVE-2020-7761
  2. Snyk Vulnerability Database | Snyk

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@absolunet/kafenpm
< 3.2.103.2.10

Affected products

3

Patches

1
c644c798bfcd

Switch email pattern to practical implementation of RFC 5322

https://github.com/absolunet/kafeJb LandryNov 5, 2020via ghsa
commit
1 file changed · +4 −1
  • src/kafe/string-validate.js+4 −1 modified
    @@ -46,7 +46,10 @@
 	validate.isEmail = function(str) {
 		str = str.replace(/^\s*|\s*$/g, '');
 		str = str.replace(/^\t*|\t*$/g, '');
-		return (/^\w+([\.\+-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/.test(str));
+
+		// Practical implementation of RFC 5322
+		// https://www.regular-expressions.info/email.html
+		return (/^[a-z0-9!#$%&'*+/=?^_‘{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_‘{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(str));
 	};

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.