The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | May 17, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | May 17, 2018 |
| Freebsd | — | Upgrade node4Upgrade nodeUpgrade node8Upgrade node6 | Dec 10, 2025 | Mar 28, 2018 |
| Suse | — | Upgrade npm10Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-langUpgrade mozilla-nss-develUpgrade mozilla-nspr-develUpgrade npm4Upgrade libsoftokn3Upgrade nodejs6Upgrade nodejs4-develUpgrade firefox-glib2-toolsUpgrade nodejs10-develUpgrade nodejs10-docsUpgrade libsoftokn3-32bitUpgrade npm6Upgrade firefox-gtk3-dataUpgrade mozilla-nss-certs-32bitUpgrade firefox-libcairo2Upgrade firefox-gtk3-toolsUpgrade firefox-glib2-langUpgrade mozilla-nss-32bitUpgrade firefox-libatk-1_0-0Upgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-toolsUpgrade libfirefox-glib-2_0-0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs4-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs8-docsUpgrade mozillafirefox-translations-otherUpgrade mozillafirefoxUpgrade firefox-libffi4Upgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nss-certsUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade libfreebl3-32bitUpgrade firefox-libffi7Upgrade mozilla-nspr-32bitUpgrade nodejs6-docsUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs6-develUpgrade nodejs4Upgrade mozillafirefox-translations-commonUpgrade nodejs8-develUpgrade npm8Upgrade firefox-gdk-pixbuf-query-loadersUpgrade nodejs8Upgrade libfirefox-gio-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-atk-langUpgrade firefox-libcairo-gobject2Upgrade libfreebl3Upgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nssUpgrade mozilla-nsprUpgrade mozillafirefox-branding-sledUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-branding-upstreamUpgrade nodejs10 | Jun 21, 2018 | Apr 16, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub