CVE-2021-36716

7.5 highEPSS 1.0%

A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2021-07-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

segment:is-email

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-j377-2x76-558h	npm	is-email	<1.0.1	1.0.1

References

https://github.com/segmentio/is-email/releases
https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/
https://github.com/segmentio/is-email/releases
https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/

Check your stack JSON