Read the docs
TI-2018-15306 Aliases CVE-2018-25079GHSA-p9w8-2mpq-49h9

Segmentio is-url index.js redos

Priority LOW 35CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The patch is identified as 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.

Why it matters now

EPSS 0.00951 61st percentileScored 2026-11-07
Fix Partial is-url (npm): 1.2.3Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Segmentiois-url1.2.0; 1.2.1; 1.2.2—No fix listedCNA
—is-url (npm)before 1.2.31.2.3Patch availableGHSA-p9w8-2mpq-49h9
  • is-url VendorSegmentio Affected 1.2.0; 1.2.1; 1.2.2 Fixed in — No fix listed CNA
  • is-url (npm) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-p9w8-2mpq-49h9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:segment:is-url:*:*:*:*:*:node.js:*:*up to 1.2.2VulnerableSegment
  • cpe:2.3:a:segment:is-url:*:*:*:*:*:node.js:*:* Versions up to 1.2.2 Vulnerable ·Segment

Remediation

  • Fix · GHSA-p9w8-2mpq-49h9 is-url (npm) Fixed in 1.2.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-25079
  2. 2026-10-03 Alias added: GHSA-p9w8-2mpq-49h9

References

Patch 3

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences