The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18n | Apr 21, 2023 | Dec 26, 2022 |
| Centos_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npm | Apr 10, 2023 | Dec 26, 2022 |
| Debian | — | Upgrade node-glob-parent | Jul 30, 2024 | Dec 26, 2022 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npm | Apr 5, 2023 | Dec 26, 2022 |
| Redhat_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoNo solution existsUpgrade nodejs-debugsource | Apr 3, 2023 | Dec 26, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npm | Mar 12, 2024 | Dec 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub