All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docs | May 4, 2022 | May 4, 2021 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debugsource | Sep 22, 2021 | May 4, 2021 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-full-i18n | Sep 23, 2021 | May 4, 2021 |
| Redhat_linux | — | No solution existsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-devel | Sep 22, 2021 | May 4, 2021 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debuginfo | May 5, 2022 | May 4, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14 | Sep 30, 2025 | May 4, 2021 |
| Suse | — | Upgrade npm8Upgrade nodejs8Upgrade npm10Upgrade nodejs12-develUpgrade nodejs10-develUpgrade nodejs8-docsUpgrade nodejs14-docsUpgrade nodejs8-develUpgrade nodejs12-docsUpgrade nodejs14Upgrade nodejs10-docsUpgrade nodejs10Upgrade nodejs12Upgrade nodejs14-develUpgrade npm14Upgrade nodejs-commonUpgrade npm12 | Feb 22, 2022 | May 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub