All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade npm | May 4, 2022 | May 4, 2021 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs | Sep 22, 2021 | May 4, 2021 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-nodemon | Sep 23, 2021 | May 4, 2021 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debuginfoNo solution existsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npm | Sep 22, 2021 | May 4, 2021 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs | May 5, 2022 | May 4, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | May 4, 2021 |
| Suse | — | Upgrade nodejs10-develUpgrade nodejs12-develUpgrade nodejs8-docsUpgrade nodejs8-develUpgrade npm8Upgrade nodejs14-docsUpgrade npm10Upgrade nodejs8Upgrade nodejs10-docsUpgrade nodejs14Upgrade nodejs12-docsUpgrade npm12Upgrade npm14Upgrade nodejs12Upgrade nodejs14-develUpgrade nodejs-commonUpgrade nodejs10 | Feb 22, 2022 | May 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub