Read the docs
TI-2020-06272 Aliases CVE-2020-7754GHSA-pw54-mh39-w3hc

Regular expression denial of service (ReDoS) in npm-user-validate

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 5 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Why it matters now

EPSS 0.03481 89th percentileScored 2026-11-07
Fix Partial npm-user-validate: 1.0.1npm-user-validate (npm): 1.0.1Red Hat: 6 advisoriesRed Hat: 5 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—npm-user-validatebefore 1.0.11.0.1Patch availableCNA
—npm-user-validate (npm)before 1.0.11.0.1Patch availableGHSA-pw54-mh39-w3hc
  • npm-user-validate Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
  • npm-user-validate (npm) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-pw54-mh39-w3hc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:npmjs:npm-user-validate:*:*:*:*:*:node.js:*:*before 1.0.1VulnerableNpmjs
  • cpe:2.3:a:npmjs:npm-user-validate:*:*:*:*:*:node.js:*:* Versions before 1.0.1 Vulnerable ·Npmjs

Remediation

  • Fix · CNA npm-user-validate Fixed in 1.0.1
  • Fix · GHSA-pw54-mh39-w3hc npm-user-validate (npm) Fixed in 1.0.1 Advisory →

Red Hat 6 advisories

  • RHSA-2021:0551 Released 2021-02-16 · Red Hat rating Moderate
    nodejs:14 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.aarch64::nodejs:14, nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.ppc64le::nodejs:14, nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.s390x::nodejs:14 +19
  • RHSA-2021:0549 Released 2021-02-16 · Red Hat rating Moderate
    nodejs:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64::nodejs:12, nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le::nodejs:12, nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.s390x::nodejs:12 +19
  • RHSA-2021:0548 Released 2021-02-16 · Red Hat rating Moderate
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64::nodejs:10, nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le::nodejs:10, nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x::nodejs:10 +19
Show 3 more Red Hat advisories
  • RHSA-2021:0521 Released 2021-02-15 · Red Hat rating Moderate
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
  • RHSA-2021:0485 Released 2021-02-11 · Red Hat rating Moderate
    rh-nodejs12-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
  • RHSA-2021:0421 Released 2021-02-04 · Red Hat rating Moderate
    rh-nodejs14-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.15.4-2.el7, rh-nodejs14-nodejs-devel-14.15.4-2.el7, rh-nodejs14-nodejs-docs-14.15.4-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs14-nodejs-14.15.4-2.el7, rh-nodejs14-nodejs-devel-14.15.4-2.el7, rh-nodejs14-nodejs-docs-14.15.4-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.15.4-2.el7, rh-nodejs14-nodejs-devel-14.15.4-2.el7, rh-nodejs14-nodejs-docs-14.15.4-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.15.4-2.el7, rh-nodejs14-nodejs-devel-14.15.4-2.el7, rh-nodejs14-nodejs-docs-14.15.4-2.el7 +1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:0548, RHSA-2021:0549, RHSA-2021:0551
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:0421, RHSA-2021:0485, RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2021:0421, RHSA-2021:0485, RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:0421, RHSA-2021:0485, RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:0421, RHSA-2021:0485, RHSA-2021:0521

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7754
  2. 2026-10-03 Alias added: GHSA-pw54-mh39-w3hc

References

Patch 1

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences