An issue exists where user email address formats are validated using a regular expression that lacks a length limit and exhibits quadratic runtime growth relative to the input length. An unauthenticated attacker with knowledge of the application ID can submit a sign-up request, or an authenticated user can update their email, using a specially crafted long email address. This action blocks the Node.js event loop, resulting in a denial of service for all clients.