~ / search / GHSA-hj48-42vr-x3v9

GHSA-hj48-42vr-x3v9

Regular Expression Denial of Service in path-parse

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23343

Packages

EcosystemPackageAffectedFixed in
npm path-parse < 1.0.7 1.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of npm package `path-parse` are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

References

External links from the advisory. They lead to third-party sites.