CVE-2026-62317: Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Logtoto a version that resolves this vulnerability.Fixed in 1.41.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Logto deployments running versions prior to 1.41.0 are exposed when email subaddressing blocking is enabled through the blockSubaddressing setting. The affected verification-code endpoint is reachable over the network, and exploitation can stall the event loop.
Does exploitation require an account or user interaction?
No. The issue has network attack vector, low complexity, no privileges required, and no user interaction required. An attacker can target POST /api/experience/verification/verification-code with crafted email input.
What services can be disrupted?
Catastrophic backtracking during email processing can stall the Logto event loop. This can make authentication, token issuance, SSO, and the administrative console unavailable.
What is the remediation if the affected feature is in use?
Upgrade Logto to version 1.41.0, which fixes the issue. If an immediate upgrade is not possible, disabling blockSubaddressing removes the condition described for constructing the vulnerable regular expression.