email-existence index.js redos
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-1333.
Summary
A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | email-existence | all versions | — | No fix listed | CNA |
| — | email-existence (npm) | up to 0.1.6 | — | No fix listed | GHSA-p27h-4cpf-fw48 |
- email-existence Vendor— Affected all versions Fixed in — No fix listed CNA
- email-existence (npm) Vendor— Affected up to 0.1.6 Fixed in — No fix listed GHSA-p27h-4cpf-fw48
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:email-existence_project:email-existence:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Email-existence Project |
- cpe:2.3:a:email-existence_project:email-existence:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Email-existence Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-25049
- 2026-10-03 Alias added: GHSA-p27h-4cpf-fw48
References
Sources
- CVE-2018-25049 · CVE Program
- CVE-2018-25049 · NVD
- FIRST EPSS
- GHSA-p27h-4cpf-fw48 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences