All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | May 4, 2021 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npm | Sep 22, 2021 | May 4, 2021 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docs | Sep 23, 2021 | May 4, 2021 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packagingNo solution existsUpgrade nodejs-debuginfo | Sep 22, 2021 | May 4, 2021 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debuginfo | May 5, 2022 | May 4, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | May 4, 2021 |
| Suse | — | Upgrade nodejs12-docsUpgrade nodejs14Upgrade nodejs10-docsUpgrade npm12Upgrade nodejs-commonUpgrade npm14Upgrade nodejs10Upgrade nodejs12Upgrade nodejs14-develUpgrade npm10Upgrade nodejs10-develUpgrade nodejs8-develUpgrade nodejs14-docsUpgrade nodejs8Upgrade npm8Upgrade nodejs8-docsUpgrade nodejs12-devel | Feb 22, 2022 | May 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub