Description
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | path-parse | < unspecified | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +3 | 1:12.22.5-1.module+el8.4.0+12242+af52a4c7 | RHSA-2021:3666, RHSA-2021:3623 |
| RHEL 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+6519+9f98ed83 | RHSA-2021:3666, RHSA-2021:3623 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHSA-2021:3666, RHSA-2021:3623 |
| RHEL 8 | npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7 | RHSA-2021:3666, RHSA-2021:3623 |
| RHEL 3 | rh-nodejs12-nodejs +2 | 12.22.5-1.el7 | RHSA-2021:3281 |
| RHEL 3 | rh-nodejs12-nodejs-nodemon +1 | 2.0.3-5.el7 | RHSA-2021:3281, RHSA-2021:3280 |
| RHEL 3 | rh-nodejs12-npm | 6.14.14-12.22.5.1.el7 | RHSA-2021:3281 |
| RHEL 3 | rh-nodejs14-nodejs +2 | 14.17.5-1.el7 | RHSA-2021:3280 |
| RHEL 3 | rh-nodejs14-npm | 6.14.14-14.17.5.1.el7 | RHSA-2021:3280 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.2.7-1.el8ev | RHSA-2021:2865 |
| RHEL 8.2 EUS | nodejs +3 | 1:12.22.5-1.module+el8.2.0+12241+a3db445b | RHSA-2021:3638 |
| RHEL 8.2 EUS | nodejs-nodemon | 1.18.3-1.module+el8.1.0+3369+37ae6a45 | RHSA-2021:3638 |
| RHEL 8.2 EUS | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHSA-2021:3638 |
| RHEL 8.2 EUS | npm | 1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b | RHSA-2021:3638 |
| RHEL 8.1 EUS | nodejs +3 | 1:12.22.5-1.module+el8.1.0+12238+63fe3aec | RHSA-2021:3639 |
| RHEL 8.1 EUS | nodejs-nodemon | 1.18.3-1.module+el8.1.0+3369+37ae6a45 | RHSA-2021:3639 |
| RHEL 8.1 EUS | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHSA-2021:3639 |
| RHEL 8.1 EUS | npm | 1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec | RHSA-2021:3639 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs +3 | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 | ALSA-2021:3623 |
| AlmaLinux 8 | nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f | ALSA-2021:3666, ALSA-2021:3623 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2021:3666, ALSA-2021:3623 |
| AlmaLinux 8 | npm | 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 | ALSA-2021:3623 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 | RLSA-2021:3666, RLSA-2021:3623 |
| Rocky Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+100+234774f7 | RLSA-2021:3666, RLSA-2021:3623 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2021:3666, RLSA-2021:3623 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SLES 15 SP3 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SLES 15 SP2 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLES 15 SP2 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLES 15 SP2 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SLES 15 SP2 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SLES 15 SP2 | nodejs8 | 8.17.0-10.19.2 | SUSE-SU-2022:0704-1 |
| SLES 15 SP1 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLES 15 SP1 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLES 15 SP1 | nodejs8 | 8.17.0-3.54.2 | SUSE-SU-2022:0563-1 |
| SLES 15 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLES 15 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLES 15 | nodejs8 | 8.17.0-3.54.2 | SUSE-SU-2022:0563-1 |
| SLES 12 | nodejs10 | 10.24.1-1.46.1 | SUSE-SU-2022:0570-1 |
| SLES 12 | nodejs12 | 12.22.10-1.42.2 | SUSE-SU-2022:0531-1 |
| SLES 12 | nodejs14 | 14.19.0-6.24.1 | SUSE-SU-2022:0569-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLES for SAP 15 SP2 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLES for SAP 15 SP2 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SLES for SAP 15 SP2 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SLES for SAP 15 SP2 | nodejs8 | 8.17.0-10.19.2 | SUSE-SU-2022:0704-1 |
| SLES for SAP 15 SP1 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLES for SAP 15 SP1 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLES for SAP 15 SP1 | nodejs8 | 8.17.0-3.54.2 | SUSE-SU-2022:0563-1 |
| SLES for SAP 15 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLES for SAP 15 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLES for SAP 15 | nodejs8 | 8.17.0-3.54.2 | SUSE-SU-2022:0563-1 |
| SLE HPC 15 SP2 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLE HPC 15 SP2 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLE HPC 15 SP2 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SLE HPC 15 SP2 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SLE HPC 15 SP2 | nodejs8 | 8.17.0-10.19.2 | SUSE-SU-2022:0704-1 |
| SLE HPC 15 SP1 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLE HPC 15 SP1 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLE HPC 15 SP1 | nodejs8 | 8.17.0-3.54.2 | SUSE-SU-2022:0563-1 |
| SLE HPC 15 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SLE HPC 15 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SLE HPC 15 | nodejs8 | 8.17.0-3.54.2 | SUSE-SU-2022:0563-1 |
| SUSE Manager Server 4.1 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SUSE Manager Server 4.1 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SUSE Manager Server 4.1 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SUSE Manager Server 4.1 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SUSE Manager Server 4.1 | nodejs8 | 8.17.0-10.19.2 | SUSE-SU-2022:0704-1 |
| SUSE Manager Retail Branch Server 4.1 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SUSE Manager Retail Branch Server 4.1 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SUSE Manager Retail Branch Server 4.1 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SUSE Manager Retail Branch Server 4.1 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SUSE Manager Retail Branch Server 4.1 | nodejs8 | 8.17.0-10.19.2 | SUSE-SU-2022:0704-1 |
| SUSE Manager Proxy 4.1 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SUSE Manager Proxy 4.1 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SUSE Manager Proxy 4.1 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SUSE Manager Proxy 4.1 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SUSE Manager Proxy 4.1 | nodejs8 | 8.17.0-10.19.2 | SUSE-SU-2022:0704-1 |
| SUSE Enterprise Storage 7 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SUSE Enterprise Storage 7 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SUSE Enterprise Storage 7 | nodejs12 | 12.22.10-4.29.3 | SUSE-SU-2022:0657-1 |
| SUSE Enterprise Storage 7 | nodejs14 | 14.19.0-15.27.1 | SUSE-SU-2022:0715-1 |
| SUSE Enterprise Storage 7 | nodejs8 | 8.17.0-10.19.2 | SUSE-SU-2022:0704-1 |
| SUSE Enterprise Storage 6 | nodejs-common | 2.0-3.4.1 | SUSE-SU-2022:0704-1 |
| SUSE Enterprise Storage 6 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| SUSE Enterprise Storage 6 | nodejs8 | 8.17.0-3.54.2 | SUSE-SU-2022:0563-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| openSUSE Leap 15.3 | nodejs10 | 10.24.1-150000.1.44.1 | SUSE-SU-2022:1717-1 |
| openSUSE Leap 15.3 | nodejs12 | 12.22.10-4.29.3 | openSUSE-SU-2022:0657-1 |
| openSUSE Leap 15.3 | nodejs14 | 14.19.0-15.27.1 | openSUSE-SU-2022:0715-1 |
| openSUSE Leap 15.3 | nodejs8 | 8.17.0-10.19.2 | openSUSE-SU-2022:0704-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +3 | 1:12.22.5-1.module+el8.4.0+20308+065a70e3 | ELSA-2021-3666, ELSA-2021-3623 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+7818+6cd30d85 | ELSA-2021-3666, ELSA-2021-3623 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5393+aaf413e3 | ELSA-2021-3666, ELSA-2021-3623 |
| Oracle Linux 8 | npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+20308+065a70e3 | ELSA-2021-3666, ELSA-2021-3623 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | path-parse | < 1.0.7 | 1.0.7 | GHSA-hj48-42vr-x3v9 |
Advisories 28
- ALSA-2021:3666 Important: nodejs:14 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2021:3623 Important: nodejs:12 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2021:3639 Red Hat Security Advisory: nodejs:12 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:3666 Red Hat Security Advisory: nodejs:14 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:3623 Red Hat Security Advisory: nodejs:12 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:3638 Red Hat Security Advisory: nodejs:12 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:3281 Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:3280 Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:2865 Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.7] Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- RLSA-2021:3623 Important: nodejs:12 security and bug fix update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2021:3666 Important: nodejs:14 security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:0657-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0531-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0704-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0704-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0569-1 Security update for nodejs14 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0715-1 Security update for nodejs14 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1717-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0715-1 Security update for nodejs14 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0570-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- openSUSE-SU-2022:0657-1 Security update for nodejs12 SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2022:0563-1 Security update for nodejs8 SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- WID-SEC-2023-0856 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 4, 2023
- ELSA-2021-3666 Important: nodejs:14 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 27, 2021
- ELSA-2021-3623 Important: nodejs:12 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 22, 2021