Logto versions before 1.41.0 contain an inefficient regular expression complexity vulnerability (CWE-1333) in the email subaddressing blocklist implementation. The vulnerable code constructs a subaddressingRegex using attacker-controlled domain input from emails when blockSubaddressing is enabled. Because the emailRegEx is permissive and accepts multiple '@' signs and regex metacharacters, it can cause catastrophic backtracking during the evaluation of subaddressingRegex.test(email). This results in an event-loop stall that disrupts authentication, token issuance, single sign-on, and administrative console availability. The vulnerability is resolved in Logto version 1.41.0.

Exploitation of this vulnerability can cause a denial of service by stalling the event loop in Logto's authentication service. This makes critical functions such as authentication, token issuance, SSO, and administrative console access unavailable. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been identified.

This vulnerability is fixed in Logto version 1.41.0. Users should upgrade to version 1.41.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the fix in 1.41.0; users should verify with the vendor advisory for the latest guidance.