Read the docs
TI-2020-17282 Aliases CVE-2020-28469GHSA-ww39-953v-wcq6

Regular expression denial of service (ReDoS) in glob-parent

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Why it matters now

EPSS 0.04579 91st percentileScored 2026-11-07
Fix Partial glob-parent: 5.1.2glob-parent (npm): 5.1.2Red Hat: 10 advisoriesRed Hat: 8 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—glob-parentbefore 5.1.25.1.2Patch availableCNA
—glob-parent (npm)4.0.0 to before 5.1.25.1.2Patch availableGHSA-ww39-953v-wcq6
  • glob-parent Vendor— Affected before 5.1.2 Fixed in 5.1.2 Patch available CNA
  • glob-parent (npm) Vendor— Affected 4.0.0 to before 5.1.2 Fixed in 5.1.2 Patch available GHSA-ww39-953v-wcq6

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gulpjs:glob-parent:*:*:*:*:*:node.js:*:*before 5.1.2VulnerableGulpjs
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
  • cpe:2.3:a:gulpjs:glob-parent:*:*:*:*:*:node.js:*:* Versions before 5.1.2 Vulnerable ·Gulpjs
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA glob-parent Fixed in 5.1.2
  • Fix · GHSA-ww39-953v-wcq6 glob-parent (npm) Fixed in 5.1.2 Advisory →

Red Hat 10 advisories

  • RHSA-2022:6595 Released 2022-09-20 · Red Hat rating Moderate
    nodejs and nodejs-nodemon security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.16.0-1.el9_0, nodejs-docs-1:16.16.0-1.el9_0, nodejs-full-i18n-1:16.16.0-1.el9_0 +3
  • RHSA-2022:0350 Released 2022-02-01 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x::nodejs:14 +19
  • RHSA-2022:0246 Released 2022-01-25 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x::nodejs:14 +19
Show 7 more Red Hat advisories
  • RHSA-2021:5171 Released 2021-12-16 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x::nodejs:16 +19
  • RHSA-2021:4626 Released 2021-11-16 · Red Hat rating Moderate
    RHV Manager (ovirt-engine) security update [ovirt-4.4.9]
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-web-ui-1.7.2-1.el8ev
  • RHSA-2021:3280 Released 2021-08-26 · Red Hat rating Important
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
  • RHSA-2021:3281 Released 2021-08-26 · Red Hat rating Important
    rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2021:2865 Released 2021-07-22 · Red Hat rating Moderate
    RHV Manager (ovirt-engine) security update [ovirt-4.4.7]
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-ui-extensions-1.2.7-1.el8ev
  • RHSA-2021:1499 Released 2021-05-04 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.2.3 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift distributed tracing 2AffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat Virtualization 4AffectedNo fix planned: Will not fix
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2021:2865, RHSA-2021:4626
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:5171, RHSA-2022:0350
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:6595
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0246
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2438
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:3280, RHSA-2021:3281
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:3280, RHSA-2021:3281
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:3280, RHSA-2021:3281
Not affected: 7 products
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-28469
  2. 2026-10-03 Alias added: GHSA-ww39-953v-wcq6

References

Patch 2

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences