All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-devel | May 4, 2022 | May 4, 2021 |
| Centos_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18n | Sep 22, 2021 | May 4, 2021 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemon | Sep 23, 2021 | May 4, 2021 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs | Sep 22, 2021 | May 4, 2021 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debuginfo | May 5, 2022 | May 4, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | May 4, 2021 |
| Suse | — | Upgrade nodejs14-develUpgrade nodejs10-docsUpgrade nodejs14Upgrade npm12Upgrade nodejs12-docsUpgrade nodejs10Upgrade nodejs-commonUpgrade nodejs12Upgrade npm14Upgrade npm8Upgrade nodejs8Upgrade npm10Upgrade nodejs10-develUpgrade nodejs14-docsUpgrade nodejs8-develUpgrade nodejs12-develUpgrade nodejs8-docs | Feb 22, 2022 | May 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub