CVE-2026-62317: Logto Authentication DoS Vulnerability

CVE-2026-62317 Overview

Logto is an open-source authentication infrastructure used by SaaS and AI applications. Versions prior to 1.41.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in the email subaddressing blocklist logic. The flaw resides in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts, where attacker-controlled domain input is used to construct a regular expression. When blockSubaddressing is enabled, a crafted email submitted to POST /api/experience/verification/verification-code can trigger catastrophic backtracking. This stalls the Node.js event loop and disrupts authentication, token issuance, single sign-on (SSO), and administrative console access. The issue is patched in version 1.41.0.

Critical Impact
Unauthenticated attackers can render Logto authentication, token issuance, SSO, and the admin console unavailable via a single crafted verification-code request.

Affected Products

Logto versions prior to 1.41.0
Deployments with blockSubaddressing enabled in sign-in experience policy
Self-hosted and Logto Cloud instances running vulnerable releases

Discovery Timeline

2026-08-19 - CVE-2026-62317 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-62317

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw classified as [CWE-1333] Inefficient Regular Expression Complexity. Logto's blocklist policy dynamically built a RegExp object from user-controlled email input to check for subaddressing (the +tag convention in the local part of an email address). Because the input validation regex emailRegEx accepted multiple @ characters and regex metacharacters, an attacker could submit input that, when embedded into the dynamic pattern, produced catastrophic backtracking. A single request to the verification-code endpoint could saturate a Node.js worker and stall the event loop, cascading into failures across authentication, token issuance, SSO, and the administrative console.

Root Cause

Two defects combine to produce the flaw. First, the emailRegEx schema guard was too permissive and allowed regex metacharacters and multiple at-signs to pass through. Second, email-blocklist-policy.ts constructed new RegExp("^.*\\+.*@${domain}$") using the attacker-supplied domain segment, then called subaddressingRegex.test(email) against the same untrusted string. Interpreting user input as a pattern created the conditions for exponential regex evaluation.

Attack Vector

An unauthenticated remote attacker sends a specifically crafted email string to the POST /api/experience/verification/verification-code endpoint. No credentials, user interaction, or prior access are required. Each malicious request consumes CPU cycles in the regex engine until the event loop is blocked, denying service to all concurrent users.

typescript

// Security patch — packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts
// Guard email subaddressing if enabled
if (blockSubaddressing) {
-    const subaddressingRegex = new RegExp(`^.*\\+.*@${domain}$`);
+    // Subaddressing puts a `+` in the local part (e.g. `user+tag@example.com`). Check the local
+    // part directly instead of building a `RegExp` from the user-controlled domain — a plain
+    // string check is simpler and avoids interpreting user input as a pattern.
+    const localPart = email.split('@')[0] ?? '';
    assertThat(
-      !subaddressingRegex.test(email),
+      !localPart.includes('+'),
      new RequestError({
        code: 'session.email_blocklist.email_subaddressing_not_allowed',
        status: 422,

Source: GitHub Commit 0213812

A companion patch in packages/schemas/src/types/interactions.ts caps input length at 256 characters as defense-in-depth against downstream email processing abuse.

Detection Methods for CVE-2026-62317

Indicators of Compromise

Sustained high CPU usage on Logto core Node.js processes without corresponding legitimate traffic volume
Event loop lag metrics spiking on the Logto backend, correlated with requests to /api/experience/verification/verification-code
POST requests to the verification-code endpoint containing email values with multiple @ characters or regex metacharacters such as (, ), *, +, or backslashes in the domain segment
Authentication, token issuance, and admin console requests timing out simultaneously

Detection Strategies

Inspect application logs and web-server access logs for anomalous payload lengths or unusual character classes in email fields submitted to the verification endpoint
Deploy a Web Application Firewall (WAF) rule to flag email parameters containing more than one @ sign or unescaped regex metacharacters
Monitor Node.js runtime metrics for event-loop lag exceeding normal baselines during authentication traffic

Monitoring Recommendations

Alert on repeated 5xx or timeout responses from /api/experience/verification/verification-code originating from a single source IP or ASN
Track average response latency of authentication endpoints and trigger alerts on sudden increases
Capture and retain full HTTP request bodies for the verification endpoint for forensic review

How to Mitigate CVE-2026-62317

Immediate Actions Required

Upgrade all Logto instances to version 1.41.0 or later without delay
Audit sign-in experience configuration and identify tenants with blockSubaddressing enabled, which are the exposed attack surface
Place rate limits on POST /api/experience/verification/verification-code at the reverse proxy or API gateway layer
Review recent logs for signs of exploitation attempts prior to patching

Patch Information

The fix is available in Logto Release v1.41.0. The patch replaces the dynamic regex construction with a direct string check on the local part of the email address and enforces a 256-character maximum length on the email schema guard. See GitHub Pull Request #9106 and GitHub Security Advisory GHSA-qp7j-c3q2-g739 for full details.

Workarounds

Temporarily disable the blockSubaddressing policy in sign-in experience settings until the upgrade is applied
Enforce strict email validation at an upstream proxy, rejecting values containing multiple @ characters or non-RFC-5321-compliant syntax
Apply aggressive request-rate limits and connection timeouts on the verification-code endpoint to bound the impact of any single malicious request

bash

# Upgrade Logto to patched release
git fetch --tags
git checkout v1.41.0
pnpm install
pnpm build
pnpm start

# Verify installed version
curl -s https://<logto-host>/api/status | jq '.version'