CVE-2016-10521

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-20

Affected software

VendorProductVersions
HackerOnejshamcrest node moduleAll versions

References

Timeline

Published
May 31, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-105228.8rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens andCVE-2016-105237.5MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible witCVE-2016-105248.2i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is usedCVE-2016-105259.8When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass autCVE-2016-105268.6A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth pCVE-2016-105277.5The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditionsCVE-2016-105284.9restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1CVE-2016-105298.8Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafteCVE-2016-10539.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and AcroCVE-2016-105305.9The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secCVE-2016-105316.1marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specificallCVE-2016-105329.8console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication a
CVE-2016-10521: High severity, CVSS 7.5 | Vulnix