Read the docs
TI-2021-14025 Aliases CVE-2021-35065GHSA-cj88-88mr-972w

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial…

Priority HIGH 66CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 14 fixed, 24 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01696 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial glob-parent (npm): 6.0.1Red Hat: 16 advisoriesRed Hat: 14 fixed, 24 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—glob-parent (npm)6.0.0 to before 6.0.16.0.1Patch availableGHSA-cj88-88mr-972w
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • glob-parent (npm) Vendor— Affected 6.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available GHSA-cj88-88mr-972w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gulpjs:glob-parent:*:*:*:*:*:node.js:*:*6.0.0 to before 6.0.1VulnerableGulpjs
  • cpe:2.3:a:gulpjs:glob-parent:*:*:*:*:*:node.js:*:* Versions 6.0.0 to before 6.0.1 Vulnerable ·Gulpjs

Remediation

  • Fix · GHSA-cj88-88mr-972w glob-parent (npm) Fixed in 6.0.1 Advisory →

Red Hat 16 advisories

  • RHSA-2025:19094 Released 2025-10-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.24.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +4
  • RHSA-2023:2655 Released 2023-05-09 · Red Hat rating Moderate
    nodejs and nodejs-nodemon security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.19.1-1.el9_2, nodejs-docs-1:16.19.1-1.el9_2, nodejs-full-i18n-1:16.19.1-1.el9_2 +3
  • RHSA-2023:2654 Released 2023-05-09 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18 +20
Show 13 more Red Hat advisories
  • RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
  • RHSA-2023:1743 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x::nodejs:14 +19
  • RHSA-2023:1583 Released 2023-04-04 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64::nodejs:18, nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le::nodejs:18, nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x::nodejs:18 +20
  • RHSA-2023:1582 Released 2023-04-04 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64::nodejs:16, nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le::nodejs:16, nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x::nodejs:16 +19
  • RHSA-2023:1533 Released 2023-03-30 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19
  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2023:0934 Released 2023-02-28 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.0 for RHEL 8 mta/mta-admin-addon-rhel8, mta/mta-hub-rhel8, mta/mta-ui-rhel8 +1
  • RHSA-2023:0634 Released 2023-02-09 · Red Hat rating Moderate
    Red Hat OpenShift (Logging Subsystem) security update
    • RHOL 5.6 for RHEL 8 openshift-logging/logging-view-plugin-rhel8
  • RHSA-2023:0612 Released 2023-02-06 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat A-MQ OnlineAffectedNo fix planned: Out of support scope
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Discovery 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix yet: Fix deferred
MTA 6.0 for RHEL 8Fixed RHSA-2023:0934
Middleware Containers for OpenShiftFixed RHSA-2023:1047
RHOL 5.6 for RHEL 8Fixed RHSA-2023:0634
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:1582, RHSA-2023:1583, RHSA-2023:1743
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2654, RHSA-2023:2655
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1533
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1742
Red Hat OpenShift Dev Spaces (RHOSDS) 3.24Fixed RHSA-2025:19094
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:0612
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:0612
Not affected: 17 products
  • MTA 6.0 for RHEL 8
  • Migration Toolkit for Containers
  • OpenShift Developer Tools and Services
  • RHOL 5.6 for RHEL 8
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24
  • Red Hat OpenShift distributed tracing 2
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-35065
  2. 2026-10-03 Alias added: GHSA-cj88-88mr-972w
  3. 2026-10-09 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 6

  • TI-2020-17282 Regular expression denial of service (ReDoS) in glob-parent CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences