{"id":"CVE-2020-7754","aliases":["ALSA-2021:0548","ALSA-2021:0549","ALSA-2021:0551","CLSA-2026-1772583197","CLSA-2026-1784682764","EUVD-2021-1154","GHSA-pw54-mh39-w3hc","GHSA-xgh6-85xh-479p","OESA-2022-1769","RHSA-2021:0421","RHSA-2021:0485","RHSA-2021:0521","RHSA-2021:0548","RHSA-2021:0549","RHSA-2021:0551","RLSA-2021:0548","RLSA-2021:0549","RLSA-2021:0551","ROOT-APP-NPM-CVE-2020-7754"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03255,"percentile":0.88439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-10-16T18:56:26Z","modified":"2026-10-29T11:12:03Z","fixes":[{"ecosystem":"npm","package":"npm-user-validate","fixed_in":["1.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"npm-user-validate","fixed_in":["0.1.2-tuxcare.1","0.1.5-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"npm-user-validate","fixed_in":["1.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/npm-user-validate","fixed_in":["1.0.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"npm-user-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"npm-user-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"npm-user-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.2-tuxcare.0"},{"fixed":"0.1.2-tuxcare.1"}]}],"versions":["0.1.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"npm-user-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5-tuxcare.0"},{"fixed":"0.1.5-tuxcare.1"}]}],"versions":["0.1.5"]},{"source":"osv","ecosystem":"npm","package":"npm-user-validate","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"npm-user-validate","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-14.15.4.2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-12.20.1.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-10.23.1.2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+9715+1718613f"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:npm","package":"npm-user-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/npm-user-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-root.io.1"}]}]}],"products":[{"vendor":"npmjs","product":"npm-user-validate"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-NPMUSERVALIDATE-1019352","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019353","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","article"]},{"url":"https://github.com/npm/npm-user-validate/commit/c8a87dac1a4cc6988b5418f30411a8669bef204e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7754","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pw54-mh39-w3hc"},{"url":"https://github.com/advisories/GHSA-xgh6-85xh-479p"},{"url":"https://errata.almalinux.org/8/ALSA-2021-0548.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15095","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-15366","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7608","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7754","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7774","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8116","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8252","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8265","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8287","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0549.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2018-3750","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10746","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10747","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0551.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-8277","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3918","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0421","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912863","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0421.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7754","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7774","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-Y18N-1021887","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8265","tags":["advisory"]},{"url":"https://hackerone.com/reports/988103","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8277","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0485","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795479","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0485.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3750","tags":["advisory"]},{"url":"https://hackerone.com/reports/311333","tags":["article"]},{"url":"https://nodesecurity.io/advisories/612","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10746","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10747","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0521","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1840004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879315","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8116","tags":["advisory"]},{"url":"https://hackerone.com/reports/719856","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0548","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0549","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0549.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0551","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0551.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0548","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0549","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0551","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-7754","title":"Regular Expression Denial of Service (ReDoS)","description":"This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.","status":"published","published":"2020-10-27T15:05:18.052Z","modified":"2024-09-17T04:28:53.351Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2021-1154","description":"This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.","status":"published","published":"2020-10-27T15:05:18Z","modified":"2024-09-17T04:28:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:23.116921Z"}],"ghsa":[{"id":"GHSA-pw54-mh39-w3hc","title":"Regular expression denial of service in npm-user-validate","description":"This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.","status":"published","published":"2021-05-10T19:08:15Z","modified":"2023-02-01T05:05:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:34.260786Z"},{"id":"GHSA-xgh6-85xh-479p","title":"Regular Expression Denial of Service in npm-user-validate","description":"`npm-user-validate` before version `1.0.1` is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with `@` characters.\n\n### Impact\nThe issue affects the `email` function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service.\n\n### Patches\nThe issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit.\n\n### Workarounds\nRestrict the character length to a reasonable degree before passing a value to `.emal()`; Also, consider doing a more rigorous sanitizing/validation beforehand.","status":"published","published":"2020-10-16T18:56:26Z","modified":"2023-01-09T05:04:15Z","updated_at":"2026-11-02T14:36:08.863482Z"}],"nvd":[{"id":"CVE-2020-7754","description":"This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.","status":"published","published":"2020-10-27T15:15:13.123Z","modified":"2026-06-17T03:25:23.267Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"CVE-2020-7754","description":"This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.","status":"published","published":"2020-10-27T15:15:13.123Z","modified":"2026-10-20T10:54:24.550471471Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"GHSA-pw54-mh39-w3hc","title":"Regular expression denial of service in npm-user-validate","description":"This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.","status":"published","published":"2021-05-10T19:08:15Z","modified":"2026-07-08T06:49:44.248240618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"OESA-2022-1769","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\r\n\r\nVersions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \u0026quot;\u0026lt;protocol\u0026gt;://[\u0026lt;user\u0026gt;[:\u0026lt;password\u0026gt;]@]\u0026lt;hostname\u0026gt;[:\u0026lt;port\u0026gt;][:][/]\u0026lt;path\u0026gt;\u0026quot;. The password value is not redacted and is printed to stdout and also to any generated log files.(CVE-2020-15095)\n\nThis affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require( y18n )(); y18n.setLocale( proto ); y18n.updateLocale({polluted: true}); console.log(polluted); // true(CVE-2020-7774)\n\nThis affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.(CVE-2020-7754)\n\nThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.(CVE-2020-7788)\n\njson-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution )(CVE-2021-3918)","status":"published","published":"2022-07-22T11:05:02Z","modified":"2026-08-18T01:16:49.916974922Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2021:0421","title":"Red Hat Security Advisory: rh-nodejs14-nodejs security update","status":"published","published":"2024-09-13T22:43:44Z","modified":"2026-10-13T10:02:07Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0485","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:44:36Z","modified":"2026-06-28T10:42:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0521","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T22:43:33Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0548","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:43:41Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0549","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:43:49Z","modified":"2026-06-28T10:42:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0551","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-09-13T22:43:56Z","modified":"2026-10-13T10:02:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-02-04T20:15:14.123658Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-02-05T12:15:07.1896Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-02-04T22:30:04.79773Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"ALSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-10-29T11:00:27.308699758Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-10-29T11:12:03.862338147Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-10-29T11:00:40.22016781Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1772583197","title":"TuxCare security update for npm-user-validate (1 CVE)","description":"TuxCare rebuilt npm-user-validate to address 1 CVE. Fixed in 0.1.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:46:59.609497074Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1784682764","title":"TuxCare security update for npm-user-validate (1 CVE)","description":"TuxCare rebuilt npm-user-validate to address 1 CVE. Fixed in 0.1.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:46Z","modified":"2026-10-15T09:47:54.160493054Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"GHSA-xgh6-85xh-479p","title":"Regular Expression Denial of Service in npm-user-validate","description":"`npm-user-validate` before version `1.0.1` is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with `@` characters.\n\n### Impact\nThe issue affects the `email` function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service.\n\n### Patches\nThe issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit.\n\n### Workarounds\nRestrict the character length to a reasonable degree before passing a value to `.emal()`; Also, consider doing a more rigorous sanitizing/validation beforehand.","status":"published","published":"2020-10-16T18:56:26Z","modified":"2026-07-08T06:49:44.248240618Z","updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"ROOT-APP-NPM-CVE-2020-7754","title":"CVE-2020-7754 in npm-user-validate - Patched by Root","description":"Root has patched CVE-2020-7754 in the npm-user-validate package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-06T12:56:17Z","modified":"2026-10-06T13:15:03.172917167Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}