The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | May 17, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | May 17, 2018 |
| Freebsd | — | Upgrade node6Upgrade node4Upgrade node8Upgrade node | Dec 10, 2025 | Mar 28, 2018 |
| Suse | — | Upgrade mozillafirefox-translations-otherUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libcairo2Upgrade firefox-gtk3-dataUpgrade npm6Upgrade firefox-glib2-toolsUpgrade mozilla-nss-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade npm10Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libffi4Upgrade mozillafirefoxUpgrade firefox-glib2-langUpgrade firefox-libpango-1_0-0Upgrade nodejs4-docsUpgrade mozilla-nss-toolsUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-32bitUpgrade nodejs6Upgrade mozilla-nss-certs-32bitUpgrade nodejs10-docsUpgrade libfirefox-glib-2_0-0Upgrade nodejs10-develUpgrade mozilla-nspr-develUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-langUpgrade nodejs4-develUpgrade libsoftokn3Upgrade libsoftokn3-32bitUpgrade firefox-libatk-1_0-0Upgrade npm4Upgrade nodejs8-develUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-multipressUpgrade npm8Upgrade firefox-gdk-pixbuf-query-loadersUpgrade nodejs10Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade libfirefox-gio-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs4Upgrade mozillafirefox-translations-commonUpgrade libfreebl3-32bitUpgrade firefox-libffi7Upgrade firefox-libcairo-gobject2Upgrade mozillafirefox-branding-sledUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-atk-langUpgrade mozilla-nsprUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nssUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs6-develUpgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-branding-upstreamUpgrade nodejs6-docsUpgrade mozilla-nspr-32bitUpgrade nodejs8Upgrade libfreebl3 | Jun 21, 2018 | Apr 16, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub