CVE-2018-25049 json
email-existence index.js redos
published 2022-12-27 3 y ago modified 2026-06-17 4 mo ago also GHSA-p27h-4cpf-fw48 , EUVD-2022-7695
- cvss
- 3.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
Patch / fix
- github.com/nmanousos/email-existence@0029ba7 commit
- github.com/nmanousos/email-existence#37 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
| CNA | 3.0 | 3.0 | CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | email-existence | <=0.1.6 |
no fix listed |
Affected products
- n/a email-existence
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/nmanousos/email-existence/pull/37
issue-tracking, web, patch, third-party-advisory
-
github.com
/nmanousos/email-existence/commit/0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56
patch, web, third-party-advisory
-
vuldb.com
/?id.216854
vdb-entry, web, permissions-required, third-party-advisory
-
vuldb.com
/?ctiid.216854
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-25049
advisory
-
github.com
/nmanousos/email-existence
package
Sources
- CVE List CVE-2018-25049
- GitHub Advisory GHSA-p27h-4cpf-fw48
- NVD CVE-2018-25049
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.