The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemon | Apr 21, 2023 | Dec 26, 2022 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docs | Apr 10, 2023 | Dec 26, 2022 |
| Debian | — | Upgrade node-glob-parent | Jul 30, 2024 | Dec 26, 2022 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemon | Apr 5, 2023 | Dec 26, 2022 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade npmUpgrade nodejs-devel | Apr 3, 2023 | Dec 26, 2022 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsource | Mar 12, 2024 | Dec 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub