The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-libs | May 4, 2022 | May 24, 2021 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packaging | Dec 17, 2021 | May 24, 2021 |
| Debian | — | Upgrade node-got | Jul 30, 2024 | May 24, 2021 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-devel | Dec 17, 2021 | May 21, 2021 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemon | Dec 17, 2021 | May 24, 2021 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade npm | Mar 5, 2024 | May 24, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | May 24, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub