CVE-2020-7754: Npmjs Npm-User-Validate

High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days.

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Affected products

• Npmjs Npm-User-Validate: before 1.0.1 (fixed in 1.0.1)

Published 2020-10-27. Last modified 2026-06-17.