GHSA-x5gf-qvw8-r2rm

pm2 Regular Expression Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2025-5891

Packages

Ecosystem	Package	Affected	Fixed in
npm	pm2	< 7.0.0	7.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability classified as problematic was found in Unitech pm2 prior to 7.0.0. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-5891 advisory
https://github.com/Unitech/pm2/issues/6075 web
https://github.com/Unitech/pm2/pull/5971 web
https://github.com/Unitech/pm2/commit/8b9354800a1d157cb9503a3ec414ef1e4700dc1c web
https://gist.github.com/mmmsssttt404/407e2ffe3e0eaa393ad923a86316a385 web
https://github.com/Unitech/pm2 package
https://github.com/Unitech/pm2/blob/ba62cae9b9b7116ee758b70f538919a52515fa26/CHANGELOG.md?plain=1#L36 web
https://github.com/Unitech/pm2/releases/tag/v7.0.0 web
https://vuldb.com/?ctiid.311662 web
https://vuldb.com/?id.311662 web
https://vuldb.com/?submit.585750 web