CVE-2026-62317

Received Received - Intake

ReDoS in Logto Email Subaddressing Blocklist Prior to 1.41.0

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-62317

EUVD

EUVD-2026-62757

Affected Vendors & Products

Vendor	Product	Version / Range
logto	logto	1.41.0
logto	logto	to 1.41.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in Logto's email subaddressing blocklist feature. When the blockSubaddressing setting is enabled, an attacker can craft malicious email inputs containing regex metacharacters. This causes catastrophic backtracking in a poorly constructed regular expression, stalling the Node.js event loop and making the entire Logto instance unresponsive.

Detection Guidance

To detect this vulnerability, check if your Logto instance is running a version prior to 1.41.0. Use the command: curl -s https://your-logto-domain.com/api/status | grep version. If the version is below 1.41.0, the system is vulnerable.

Impact Analysis

An attacker can exploit this to disrupt authentication, token issuance, SSO, and administrative console functionality. The system may become completely unavailable due to event loop stalls, and repeated attacks could lead to prolonged service outages affecting all users and services relying on Logto.

Mitigation Strategies

Upgrade Logto to version 1.41.0 or later immediately. If upgrading is not possible, disable the email subaddressing blocklist feature or implement input validation to sanitize email addresses before regex processing.

Hi! I’m here to help you understand CVE-2026-62317. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70