Read the docs
TI-2021-06041 Aliases CVE-2021-23343GHSA-hj48-42vr-x3v9

Regular expression denial of service (ReDoS) in path-parse

Priority LOW 37CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Why it matters now

EPSS 0.02218 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial path-parse (npm): 1.0.7Red Hat: 8 advisoriesRed Hat: 8 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—path-parseall versions—No fix listedCNA
—path-parse (npm)before 1.0.71.0.7Patch availableGHSA-hj48-42vr-x3v9
  • path-parse Vendor— Affected all versions Fixed in — No fix listed CNA
  • path-parse (npm) Vendor— Affected before 1.0.7 Fixed in 1.0.7 Patch available GHSA-hj48-42vr-x3v9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:path-parse_project:path-parse:*:*:*:*:*:node.js:*:*before 1.0.7VulnerablePath-parse Project
  • cpe:2.3:a:path-parse_project:path-parse:*:*:*:*:*:node.js:*:* Versions before 1.0.7 Vulnerable ·Path-parse Project

Remediation

  • Fix · GHSA-hj48-42vr-x3v9 path-parse (npm) Fixed in 1.0.7 Advisory →

Red Hat 8 advisories

  • RHSA-2021:4902 Released 2021-12-01 · Red Hat rating Moderate
    ACS 3.67 security and enhancement update
    • RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator
  • RHSA-2021:3666 Released 2021-09-27 · Red Hat rating Important
    nodejs:14 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.17.5-1.module+el8.4.0+12247+e2879e58.aarch64::nodejs:14, nodejs-1:14.17.5-1.module+el8.4.0+12247+e2879e58.ppc64le::nodejs:14, nodejs-1:14.17.5-1.module+el8.4.0+12247+e2879e58.s390x::nodejs:14 +19
  • RHSA-2021:3638 Released 2021-09-22 · Red Hat rating Important
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.s390x::nodejs:12 +19
Show 5 more Red Hat advisories
  • RHSA-2021:3639 Released 2021-09-22 · Red Hat rating Important
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.s390x::nodejs:12 +19
  • RHSA-2021:3623 Released 2021-09-21 · Red Hat rating Important
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.s390x::nodejs:12 +19
  • RHSA-2021:3280 Released 2021-08-26 · Red Hat rating Important
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
  • RHSA-2021:3281 Released 2021-08-26 · Red Hat rating Important
    rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
  • RHSA-2021:2865 Released 2021-07-22 · Red Hat rating Moderate
    RHV Manager (ovirt-engine) security update [ovirt-4.4.7]
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-ui-extensions-1.2.7-1.el8ev

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix planned: Out of support scope
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Openshift Container Storage 4AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix planned: Out of support scope
Red Hat Virtualization 4AffectedNo fix yet: Fix deferred
RHACS 3.67 for RHEL 8Fixed RHSA-2021:4902
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2021:2865
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3623, RHSA-2021:3666
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2021:3639
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:3638
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:3280, RHSA-2021:3281
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:3280, RHSA-2021:3281
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:3280, RHSA-2021:3281
Not affected: 9 products
  • RHACS 3.67 for RHEL 8
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ceph Storage 4
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23343
  2. 2026-10-03 Alias added: GHSA-hj48-42vr-x3v9

References

Exploit 1

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences