The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | May 17, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | May 17, 2018 |
| Freebsd | — | Upgrade node4Upgrade nodeUpgrade node8Upgrade node6 | Dec 10, 2025 | Mar 28, 2018 |
| Suse | — | Upgrade firefox-libcairo2Upgrade firefox-gtk3-dataUpgrade npm4Upgrade libfirefox-gthread-2_0-0Upgrade npm6Upgrade nodejs4-develUpgrade nodejs4-docsUpgrade npm10Upgrade libsoftokn3Upgrade firefox-glib2-toolsUpgrade firefox-gtk3-toolsUpgrade nodejs10-develUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-glib2-langUpgrade firefox-libharfbuzz0Upgrade MozillaFirefox-translations-commonUpgrade nodejs10-docsUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-32bitUpgrade libsoftokn3-32bitUpgrade firefox-libffi4Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-develUpgrade nodejs6Upgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-langUpgrade nodejs8-docsUpgrade firefox-libatk-1_0-0Upgrade libfirefox-glib-2_0-0Upgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-vietnameseUpgrade libfreebl3-32bitUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gio-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade nodejs4Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nspr-32bitUpgrade firefox-libgtk-3-0Upgrade nodejs8-develUpgrade firefox-atk-langUpgrade firefox-libcairo-gobject2Upgrade mozilla-nsprUpgrade mozilla-nssUpgrade nodejs6-docsUpgrade libfreebl3Upgrade firefox-gdk-pixbuf-langUpgrade nodejs6-develUpgrade firefox-gdk-pixbuf-query-loadersUpgrade npm8Upgrade nodejs8Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs10Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-libffi7 | Jun 21, 2018 | Apr 16, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 17, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub