GHSA-hj48-42vr-x3v9

Regular Expression Denial of Service in path-parse

At a glance

Published: 2021-08-10 15:33 UTC
Updated: 2025-01-14 08:57 UTC
CVE: CVE-2021-23343
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

Affected versions of npm package `path-parse` are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Affected packages

Package	Versions
npm · path-parse	introduced 0, fixed 1.0.7

References

https://nvd.nist.gov/vuln/detail/CVE-2021-23343 ADVISORY
https://github.com/jbgutierrez/path-parse/issues/8 WEB
https://github.com/jbgutierrez/path-parse/pull/10 WEB
https://github.com/jbgutierrez/path-parse/commit/eca63a7b9a473bf6978a2f5b7b3343662d1506f7 WEB
https://github.com/jbgutierrez/path-parse PACKAGE
https://lists.apache.org/thread.html/r6a32cb3eda3b19096ad48ef1e7aa8f26e005f2f63765abb69ce08b85@%3Cdev.myfaces.apache.org%3E WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028 WEB
https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database