Read the docs
TI-2025-18937 Aliases CVE-2025-25283GHSA-hcrg-fc28-fcg5

parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory

Priority HIGH 66CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00774 55th percentileScored 2026-11-07
Fix Fixed parse-duration (jkroso): 2.1.3parse-duration (npm): 2.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jkrosoparse-durationbefore 2.1.32.1.3Patch availableCNA
—parse-duration (npm)before 2.1.32.1.3Patch availableGHSA-hcrg-fc28-fcg5
  • parse-duration Vendorjkroso Affected before 2.1.3 Fixed in 2.1.3 Patch available CNA
  • parse-duration (npm) Vendor— Affected before 2.1.3 Fixed in 2.1.3 Patch available GHSA-hcrg-fc28-fcg5

Remediation

  • Fix · CNA parse-duration (jkroso) Fixed in 2.1.3
  • Fix · GHSA-hcrg-fc28-fcg5 parse-duration (npm) Fixed in 2.1.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25283
  2. 2026-10-03 Alias added: GHSA-hcrg-fc28-fcg5

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences