All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemon | May 4, 2022 | May 4, 2021 |
| Centos_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docs | Sep 22, 2021 | May 4, 2021 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs | Sep 23, 2021 | May 4, 2021 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debugsourceNo solution existsUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade npm | Sep 22, 2021 | May 4, 2021 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade npm | May 5, 2022 | May 4, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.2.11 | Sep 30, 2025 | May 4, 2021 |
| Suse | — | Upgrade npm8Upgrade npm10Upgrade nodejs14-docsUpgrade nodejs8Upgrade nodejs8-develUpgrade nodejs8-docsUpgrade nodejs12-develUpgrade nodejs10-develUpgrade npm14Upgrade nodejs10-docsUpgrade nodejs12Upgrade nodejs10Upgrade nodejs14Upgrade nodejs-commonUpgrade npm12Upgrade nodejs14-develUpgrade nodejs12-docs | Feb 22, 2022 | May 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub