CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2021-23388
Medium (5.3) in forms project forms. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in forms 1.3.2.
The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- forms_project:forms
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c56f-grv3-gpfr | npm | forms | <1.3.2 | 1.3.2 |
References
- https://github.com/caolan/forms/pull/214
- https://github.com/caolan/forms/pull/214/commits/d4bd5b5febfe49c1f585f162e04ec810f8dc47a0
- https://snyk.io/vuln/SNYK-JS-FORMS-1296389
- https://github.com/caolan/forms/pull/214
- https://github.com/caolan/forms/pull/214/commits/d4bd5b5febfe49c1f585f162e04ec810f8dc47a0