The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | May 17, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | May 17, 2018 |
| Freebsd | — | Upgrade nodeUpgrade node4Upgrade node8Upgrade node6 | Dec 10, 2025 | Mar 28, 2018 |
| Suse | — | Upgrade libfirefox-gthread-2_0-0Upgrade nodejs6Upgrade libsoftokn3Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-langUpgrade firefox-gtk3-toolsUpgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade MozillaFirefoxUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libcairo2Upgrade npm10Upgrade nodejs10-docsUpgrade mozilla-nspr-develUpgrade npm6Upgrade nodejs8-docsUpgrade nodejs4-develUpgrade firefox-glib2-toolsUpgrade npm4Upgrade nodejs4-docsUpgrade mozilla-nss-develUpgrade libsoftokn3-32bitUpgrade nodejs10-develUpgrade mozilla-nss-certs-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-glib2-langUpgrade firefox-libffi4Upgrade MozillaFirefox-translations-commonUpgrade firefox-libharfbuzz0Upgrade MozillaFirefox-translations-otherUpgrade firefox-libgtk-3-0Upgrade nodejs8-develUpgrade firefox-gio-branding-upstreamUpgrade mozilla-nsprUpgrade nodejs4Upgrade libfreebl3-32bitUpgrade libfirefox-gio-2_0-0Upgrade firefox-atk-langUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs6-develUpgrade nodejs6-docsUpgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-langUpgrade mozilla-nssUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade nodejs8Upgrade npm8Upgrade firefox-libcairo-gobject2Upgrade firefox-gdk-pixbuf-query-loadersUpgrade libfreebl3Upgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs10Upgrade firefox-libffi7 | Jun 21, 2018 | Apr 16, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub