What’s Vulnerable › Vulnerabilities

CVE-2020-7761: Regular Expression Denial of Service (ReDoS)

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-05 · updated 2026-06-17

Description

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.

Affected products

• @absolunet/kafe: before 3.2.10 — fixed in 3.2.10

How to fix

Upgrade to a fixed version: @absolunet/kafe 3.2.10. Check the vendor advisory for mitigations.

References

• https://github.com/absolunet/kafe/commit/c644c798bfcdc1b0bbb1f0ca59e2e2664ff3fdd0%23diff-f0f4b5b19ad46588ae9d7dc1889f681252b0698a4ead3a77b7c7d127ee657857
• https://snyk.io/vuln/SNYK-JS-ABSOLUNETKAFE-1017403
• https://github.com/absolunet/kafe/commit/c644c798bfcdc1b0bbb1f0ca59e2e2664ff3fdd0%23diff-f0f4b5b19ad46588ae9d7dc1889f681252b0698a4ead3a77b7c7d127ee657857
• https://snyk.io/vuln/SNYK-JS-ABSOLUNETKAFE-1017403

Get alerted when CVE-2020-7761 or the next vulnerability affects your stack