CVE-2020-28469 json
Regular Expression Denial of Service (ReDoS)
published 2021-06-03 5 y ago modified 2026-09-08 2 mo ago also BIT-gulp-2020-28469 , EUVD-2021-1421 , GHSA-ww39-953v-wcq6
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.6%
- EPSS 4.6% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Patch / fix
- npm glob-parent 5.1.2
- bitnami gulp 5.1.2
- n/a glob-parent 5.1.2
- node-glob-parent Debian 14, Debian 13, Debian 12 5.1.1+~5.1.0-2
debian advisories DEBIAN-CVE-2020-28469
- npm RHEL 8 1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
- nodejs RHEL 8 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
- nodejs-nodemon RHEL 8 2.0.15-1.module+el8.5.0+13504+a2e74d91
- nodejs-full-i18n RHEL 8 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
- nodejs-packaging RHEL 8, RHEL 8.4 EUS 23-3.module+el8.3.0+6519+9f98ed83
- npm RHEL 8 1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af
- nodejs RHEL 8 1:16.13.1-3.module+el8.5.0+13548+45d748af
- nodejs-nodemon RHEL 8 2.0.15-1.module+el8.5.0+13548+45d748af
red hat advisories RHSA-2022:0350RHSA-2021:5171RHSA-2022:0246RHSA-2021:4626RHSA-2021:2865RHSA-2022:6595
- nodejs AlmaLinux 9 1:16.16.0-1.el9_0
- nodejs-nodemon AlmaLinux 9 2.0.19-1.el9_0
- npm AlmaLinux 9 1:8.11.0-1.16.16.0.1.el9_0
- nodejs-libs AlmaLinux 9 1:16.16.0-1.el9_0
- nodejs-full-i18n AlmaLinux 9 1:16.16.0-1.el9_0
- npm AlmaLinux 8 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
- npm AlmaLinux 8 1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
- nodejs AlmaLinux 8 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
almalinux advisories ALSA-2022:6595ALSA-2022:0350ALSA-2021:5171
- nodejs-nodemon Rocky Linux 9 2.0.19-1.el9_0
- nodejs Rocky Linux 8 1:14.18.2-2.module+el8.5.0+733+de4fee6c
- nodejs-nodemon Rocky Linux 8 2.0.15-1.module+el8.5.0+721+4c107270
- nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
- nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
- nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c
- nodejs Rocky Linux 8 1:16.13.1-3.module+el8.5.0+721+4c107270
- nodejs-packaging Rocky Linux 8 25-1.module+el8.6.0+1046+80feca58
rocky linux advisories RLSA-2022:6595RLSA-2022:0350RLSA-2021:5171
- github.com/gulpjs/glob-parent#36 commit
- github.com/gulpjs/glob-parent@4a80667 commit
- github.com/gulpjs/glob-parent#36 pull request
- github.com/gulpjs/glob-parent/releases/tag/v5.1.2 release
- oracle.com/security-alerts/cpujan2022.html advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-28469 updated cvss 7.5
nodejs-glob-parent: Regular expression denial of service
-
Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheusaffected: no fix available
-
Red Hat Advanced Cluster Management for Kubernetes 2 grc-ui-container, rhacm2/console-rhel8, search-api-container, rhacm2/search-ui-rhel8, rhacm2/kui-web-terminal, rhacm2/search-api-rhel8, +5 more Red Hat Enterprise Linux 8 nodejs-nodemon Red Hat OpenShift Container Platform 4 openshift4/ose-grafana, openshift4/ose-thanos-rhel9, openshift4/ose-prometheus-rhel9 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-all-in-one-rhel8affected: no fix available “Fix deferred”
-
Red Hat Quay 3 quay/quay-rhel8affected: no fix planned “Will not fix”
-
Red Hat Software Collections rh-nodejs10-nodejs-nodemonaffected: no fix available “Fix deferred”
-
Red Hat Virtualization 4 cockpit-ovirt-uiplugin, cockpit-ovirt-dashboardaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.18.2-2.module+el8.5.0+13644+8d46dafd, nodejs 16.13.1-3.module+el8.5.0+13548+45d748af, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af, nodejs-nodemon 2.0.15-1.module+el8.5.0+13504+a2e74d91, +4 morefixed: vendor fix RHSA-2022:0350
-
Red Hat Enterprise Linux AppStream (v. 9) nodejs-nodemon 2.0.19-1.el9_0fixed: vendor fix RHSA-2022:6595
-
Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.18.2-2.module+el8.4.0+13643+6c0ebf22, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.15-1.module+el8.4.0+13503+fc29810b, npm 6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22, nodejs-full-i18n 14.18.2-2.module+el8.4.0+13643+6c0ebf22fixed: vendor fix RHSA-2022:0246
show 4 moreshow fewer
-
Red Hat OpenShift Container Platform 4.8 openshift4/ose-console v4.8.0-202107010336.p0.git.188a490.assembly.streamfixed: vendor fix RHSA-2021:2438
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7, rh-nodejs14-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7, rh-nodejs14-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7, rh-nodejs14-nodejs-nodemon 2.0.3-5.el7fixed: vendor fix RHSA-2021:3281
-
Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-web-ui 1.7.2-1.el8ev, ovirt-engine-ui-extensions 1.2.7-1.el8evfixed: vendor fix RHSA-2021:2865
-
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-ui-rhel8 Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.16.0-1.el9_0, nodejs-libs 16.16.0-1.el9_0, npm 8.11.0-1.16.16.0.1.el9_0, nodejs-full-i18n 16.16.0-1.el9_0 Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202106291725.p0.git.1077b05.assembly.stream, openshift4/ose-pod v4.8.0-202107161820.p0.git.051ac4f.assembly.stream, openshift4/ose-etcd v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream, openshift4/ose-tests v4.8.0-202107131424.p0.git.0d958c3.assembly.stream, openshift4/ose-coredns v4.8.0-202106291913.p0.git.642b46e.assembly.stream, openshift4/ose-grafana v4.8.0-202106291913.p0.git.b987e4b.assembly.stream, +135 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7not affected: vulnerable code not present
+1 more productsfewer
Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.4.9.2-0.6.el8ev, rhvm 4.4.7.6-0.11.el8ev, ovirt-web-ui 1.7.0-1.el8ev, ovirt-engine 4.4.9.2-0.6.el8ev, ovirt-engine 4.4.7.6-0.11.el8ev, rhvm-branding-rhv 4.4.9-1.el8ev, +49 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
4.58% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- snyk.io https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 referenced PoC, tagged "exploit" by a source, unverified
- snyk.io https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092 referenced PoC, tagged "exploit" by a source, unverified
- snyk.io https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | glob-parent | >=4.0.0, <5.1.2 |
5.1.2 |
| bitnami | gulp | <5.1.2 |
5.1.2 |
Affected products
- n/a glob-parent
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/gulpjs/glob-parent/pull/36
web, patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory, advisory
-
github.com
/gulpjs/glob-parent/pull/36/commits/c6db86422a9731d4f3d332ce4a81c27ea6b0ee46
web
-
github.com
/gulpjs/glob-parent/commit/4a80667c69355c76a572a5892b0f133c8e1f457e
web
-
snyk.io
/vuln/SNYK-JS-GLOBPARENT-1016905
web, exploit, third-party-advisory, advisory
-
snyk.io
/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092
web, exploit, third-party-advisory, advisory
-
snyk.io
/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093
web, exploit, third-party-advisory, advisory
-
github.com
/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9
web, broken-link
-
github.com
/gulpjs/glob-parent/releases/tag/v5.1.2
web, release-notes, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-28469
advisory, web
-
github.com
/gulpjs/glob-parent
package
Sources
- CVE List CVE-2020-28469
- GitHub Advisory GHSA-ww39-953v-wcq6
- NVD CVE-2020-28469
- OSV BIT-gulp-2020-28469
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.