Regular Expression Denial of Service in path-parse

HOCH 7.5CVE-2021-23343 · GHSA-hj48-42vr-x3v9 · Published 04/05/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-23343 ist eine Schwachstelle (HOCH (CVSS 7.5)) in path-parse (path-parse project), path-parse.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.2%, höher als bei 82.8% aller Schwachstellen.
Abhilfe: auf 1.0.7 oder neuer aktualisieren.

Package	Affected versions	Patched versions
path-parse path-parse_project	`< 1.0.7`	`1.0.7`
path-parse npm	`< 1.0.7`	`1.0.7`

Description

Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

NVD description

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free