The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | May 24, 2021 |
| Centos_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-devel | Dec 17, 2021 | May 24, 2021 |
| Debian | — | Upgrade node-got | Jul 30, 2024 | May 24, 2021 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Dec 17, 2021 | May 21, 2021 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-nodemon | Dec 17, 2021 | May 24, 2021 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18n | Mar 5, 2024 | May 24, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11 | Sep 30, 2025 | May 24, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub