The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | May 17, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | May 17, 2018 |
| Freebsd | — | Upgrade node6Upgrade nodeUpgrade node8Upgrade node4 | Dec 10, 2025 | Mar 28, 2018 |
| Suse | — | Upgrade firefox-gtk3-langUpgrade mozilla-nss-32bitUpgrade nodejs6Upgrade firefox-glib2-langUpgrade libsoftokn3Upgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-ximUpgrade nodejs10-develUpgrade nodejs4-develUpgrade mozilla-nspr-develUpgrade npm10Upgrade MozillaFirefoxUpgrade mozilla-nss-certs-32bitUpgrade firefox-libffi4Upgrade firefox-libharfbuzz0Upgrade npm4Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade libfirefox-gthread-2_0-0Upgrade MozillaFirefox-translations-commonUpgrade firefox-libatk-1_0-0Upgrade firefox-libpango-1_0-0Upgrade nodejs10-docsUpgrade nodejs8-docsUpgrade firefox-gtk3-dataUpgrade libsoftokn3-32bitUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade npm6Upgrade firefox-libcairo2Upgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-toolsUpgrade libfirefox-glib-2_0-0Upgrade nodejs4-docsUpgrade firefox-libffi7Upgrade nodejs10Upgrade firefox-gio-branding-upstreamUpgrade mozilla-nsprUpgrade nodejs8-develUpgrade libfreebl3-32bitUpgrade nodejs4Upgrade mozilla-nspr-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nssUpgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-langUpgrade nodejs6-develUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-atk-langUpgrade libfirefox-gobject-2_0-0Upgrade libfreebl3Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-gio-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade npm8Upgrade nodejs6-docsUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libcairo-gobject2Upgrade nodejs8 | Jun 21, 2018 | Apr 16, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub