Read the docs
TI-2021-12904 Aliases CVE-2021-33502GHSA-px4h-xg32-q955

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for…

Priority LOW 36CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Why it matters now

EPSS 0.01705 77th percentileScored 2026-11-07
Fix Partial normalize-url (npm): 4.5.1, 5.3.1, 6.0.1Red Hat: 7 advisoriesRed Hat: 7 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—normalize-url (npm)4.3.0 to before 4.5.14.5.1Patch availableGHSA-px4h-xg32-q955
—normalize-url (npm)5.0.0 to before 5.3.15.3.1Patch availableGHSA-px4h-xg32-q955
—normalize-url (npm)6.0.0 to before 6.0.16.0.1Patch availableGHSA-px4h-xg32-q955
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • normalize-url (npm) Vendor— Affected 4.3.0 to before 4.5.1 Fixed in 4.5.1 Patch available GHSA-px4h-xg32-q955
  • normalize-url (npm) Vendor— Affected 5.0.0 to before 5.3.1 Fixed in 5.3.1 Patch available GHSA-px4h-xg32-q955
  • normalize-url (npm) Vendor— Affected 6.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available GHSA-px4h-xg32-q955

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:normalize-url_project:normalize-url:*:*:*:*:*:node.js:*:*4.3.0 to before 4.5.1; 5.0.0 to before 5.3.1VulnerableNormalize-url Project
cpe:2.3:a:normalize-url_project:normalize-url:6.0.0:*:*:*:*:node.js:*:*6.0.0VulnerableNormalize-url Project
  • cpe:2.3:a:normalize-url_project:normalize-url:*:*:*:*:*:node.js:*:* Versions 4.3.0 to before 4.5.1; 5.0.0 to before 5.3.1 Vulnerable ·Normalize-url Project
  • cpe:2.3:a:normalize-url_project:normalize-url:6.0.0:*:*:*:*:node.js:*:* Versions 6.0.0 Vulnerable ·Normalize-url Project

Remediation

  • Fix · GHSA-px4h-xg32-q955 normalize-url (npm) Fixed in 4.5.1 Advisory →
  • Fix · GHSA-px4h-xg32-q955 normalize-url (npm) Fixed in 5.3.1 Advisory →
  • Fix · GHSA-px4h-xg32-q955 normalize-url (npm) Fixed in 6.0.1 Advisory →

Red Hat 7 advisories

  • RHSA-2022:6595 Released 2022-09-20 · Red Hat rating Moderate
    nodejs and nodejs-nodemon security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.16.0-1.el9_0, nodejs-docs-1:16.16.0-1.el9_0, nodejs-full-i18n-1:16.16.0-1.el9_0 +3
  • RHSA-2022:4711 Released 2022-05-26 · Red Hat rating Moderate
    RHV Manager (ovirt-engine) [ovirt-4.5.0] security update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.0.7-0.9.el8ev, ovirt-engine-backend-4.5.0.7-0.9.el8ev, ovirt-engine-dbscripts-4.5.0.7-0.9.el8ev +19
  • RHSA-2022:0350 Released 2022-02-01 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x::nodejs:14 +19
Show 4 more Red Hat advisories
  • RHSA-2022:0246 Released 2022-01-25 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x::nodejs:14 +19
  • RHSA-2021:5171 Released 2021-12-16 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x::nodejs:16 +19
  • RHSA-2021:2932 Released 2021-07-28 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
  • RHSA-2021:2931 Released 2021-07-28 · Red Hat rating Moderate
    rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2022:4711
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:5171, RHSA-2022:0350
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:6595
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0246
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:2931, RHSA-2021:2932
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:2931, RHSA-2021:2932
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:2931, RHSA-2021:2932
Not affected: 7 products
  • OpenShift Service Mesh 2.0
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33502
  2. 2026-10-03 Alias added: GHSA-px4h-xg32-q955

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences