Read the docs
TI-2021-04368 Aliases CVE-2021-21267GHSA-f38p-c2gq-4pmr

Regular Expression Denial-of-Service in npm schema-inspector

Priority LOW 37CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected. Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS.

Why it matters now

EPSS 0.0209 81st percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed schema-inspector (schema-inspector): 2.0.0schema-inspector (npm): 2.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
schema-inspectorschema-inspectorbefore 2.0.02.0.0Patch availableCNA
—schema-inspector (npm)before 2.0.02.0.0Patch availableGHSA-f38p-c2gq-4pmr
  • schema-inspector Vendorschema-inspector Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • schema-inspector (npm) Vendor— Affected before 2.0.0 Fixed in 2.0.0 Patch available GHSA-f38p-c2gq-4pmr

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:schema-inspector_project:schema-inspector:*:*:*:*:*:node.js:*:*before 2.0.0VulnerableSchema-inspector Project
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:schema-inspector_project:schema-inspector:*:*:*:*:*:node.js:*:* Versions before 2.0.0 Vulnerable ·Schema-inspector Project
  • cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA schema-inspector (schema-inspector) Fixed in 2.0.0
  • Fix · GHSA-f38p-c2gq-4pmr schema-inspector (npm) Fixed in 2.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21267
  2. 2026-10-03 Alias added: GHSA-f38p-c2gq-4pmr

References

Sources