Skip to content

Zod denial of service vulnerability during email validation

High severity GitHub Reviewed Published Oct 3, 2023 in RobinTail/express-zod-api

Package

npm express-zod-api (npm)

Affected versions

< 10.0.0-beta1

Patched versions

10.0.0-beta1

Description

Impact

API servers running express-zod-api having:

  • version of express-zod-api below 10.0.0-beta1,
  • and using the following (or similar) validation schema in its implementation: z.string().email(),

are vulnerable to a DoS attack due to:

  • Inefficient Regular Expression Complexity in zod versions up to 3.22.2,
  • depending on zod.

Patches

The patched version of zod fixing the vulnerability is 3.22.3.

However, it's highly recommended to upgrade express-zod-api to at least version 10.0.0, which does not depend on zod strictly and directly, but requires its installation as a peer dependency instead, enabling you to install the patched zod version yourself.

Workarounds

When it's not possible to upgrade your dependencies, consider the following replacement in your implementation:

- z.string().email()
+ z.string().regex(
+   /^(?!\.)(?!.*\.\.)([A-Z0-9_+-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i
+ )

This regular expression is taken from the suggested patch of zod.

References

References

@RobinTail RobinTail published to RobinTail/express-zod-api Oct 3, 2023
Published to the GitHub Advisory Database Oct 4, 2023
Reviewed Oct 4, 2023

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-mvrp-3cvx-c325
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.