Skip to content
Fencer Vulns
high 7.5

CVE-2018-7158 json

The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector.

published 2018-05-17 8 y ago modified 2026-10-08 31 d ago also EUVD-2018-18901

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.5%
EPSS 3.5% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.

Patch / fix

  • nodejs Debian 14, Debian 13, Debian 12 6.0.0~dfsg-1

debian advisories DEBIAN-CVE-2018-7158

  • nodejs6 SLE Module for Web and Scripting 12, OpenStack Cloud 7, Enterprise Storage 4 6.14.1-11.12.1
  • nodejs4 SLE Module for Web and Scripting 12, Enterprise Storage 4 4.9.1-15.11.1
  • firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
  • mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
  • firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3
  • mozilla-nspr SLES 11 SP4-LTSS 4.21-29.6.1
  • firefox-cairo SLES 11 SP4-LTSS 1.15.10-2.13.4
  • firefox-glib2 SLES 11 SP4-LTSS 2.54.3-2.14.7

suse advisories SUSE-SU-2019:14246-1SUSE-SU-2018:1183-1SUSE-SU-2018:0952-1

  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 8.11.0-r0
  • nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 9.10.0-r0

alpine advisories ALPINE-CVE-2018-7158

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-7158 updated cvss 5.9

nodejs: path module regular expression denial of service

  • Red Hat Software Collections rh-nodejs4-nodejs
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat OpenShift Enterprise 3 nodejs Red Hat Software Collections rh-nodejs8-npm, rh-nodejs6-nodejs, rh-nodejs8-nodejs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

3.45% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • The Node.js Project Node.js

Classification

Weakness
  • CWE-185 Incorrect Regular Expression
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.