Read the docs
TI-2021-06085 Aliases CVE-2021-23392GHSA-39q4-p535-c852

Regular expression denial of service (ReDoS) in locutus

Priority LOW 37CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

Why it matters now

EPSS 0.01936 80th percentileScored 2026-11-07
Fix Fixed locutus: 2.0.15locutus (npm): 2.0.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—locutusbefore 2.0.152.0.15Patch availableCNA
—locutus (npm)before 2.0.152.0.15Patch availableGHSA-39q4-p535-c852
  • locutus Vendor— Affected before 2.0.15 Fixed in 2.0.15 Patch available CNA
  • locutus (npm) Vendor— Affected before 2.0.15 Fixed in 2.0.15 Patch available GHSA-39q4-p535-c852

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:*before 2.0.15Vulnerablelocutusjs
  • cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:* Versions before 2.0.15 Vulnerable ·locutusjs

Remediation

  • Fix · CNA locutus Fixed in 2.0.15
  • Fix · GHSA-39q4-p535-c852 locutus (npm) Fixed in 2.0.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23392
  2. 2026-10-03 Alias added: GHSA-39q4-p535-c852

References

Patch 2

Advisory 1

  • TI-2026-24833 Locutus: RCE via unsanitized input in create_function() CVSS 3.1CRITICAL 9.8
  • TI-2026-26333 Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() CVSS 4.0MEDIUM 6.9
  • TI-2026-23234 Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection CVSS 3.1HIGH 8.1
  • TI-2026-26334 Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 CVSS 4.0MEDIUM 6.3
  • TI-2020-06239 Prototype pollution in locutus CVSS 3.1CRITICAL 9.8
  • TI-2026-20630 Locutus is vulnerable to Prototype Pollution CVSS 4.0CRITICAL 9.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences