Skip to content
Fencer Vulns
medium 5.3

CVE-2021-23343 json

Regular Expression Denial of Service (ReDoS)

published 2021-05-04 5 y ago modified 2026-06-17 4 mo ago also GHSA-hj48-42vr-x3v9 , EUVD-2021-1748

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Patch / fix

  • npm path-parse 1.0.7
  • path-parse_project path-parse 1.0.7
  • npm RHEL 8 1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
  • nodejs RHEL 8 1:14.17.5-1.module+el8.4.0+12247+e2879e58
  • nodejs-nodemon RHEL 8 2.0.3-1.module+el8.3.0+6519+9f98ed83
  • nodejs-full-i18n RHEL 8 1:14.17.5-1.module+el8.4.0+12247+e2879e58
  • nodejs-packaging RHEL 8 23-3.module+el8.3.0+6519+9f98ed83
  • nodejs-packaging RHEL 8, RHEL 8.2 EUS, RHEL 8.1 EUS 17-3.module+el8.1.0+3369+37ae6a45
  • npm RHEL 8 1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
  • nodejs RHEL 8 1:12.22.5-1.module+el8.4.0+12242+af52a4c7

red hat advisories RHSA-2021:3666RHSA-2021:3639RHSA-2021:3638RHSA-2021:3623RHSA-2021:2865RHSA-2021:3280

  • nodejs10 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +18 more 10.24.1-150000.1.44.1
  • nodejs14 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +7 more 14.19.0-15.27.1
  • nodejs8 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +6 more 8.17.0-10.19.2
  • nodejs-common SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +16 more 2.0-3.4.1
  • nodejs12 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +7 more 12.22.10-4.29.3
  • nodejs10 SLE Module for Web and Scripting 12 10.24.1-1.46.1
  • nodejs14 SLE Module for Web and Scripting 12 14.19.0-6.24.1
  • nodejs8 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 8.17.0-3.54.2

suse advisories SUSE-SU-2022:1717-1SUSE-SU-2022:0715-1SUSE-SU-2022:0704-1SUSE-SU-2022:0657-1SUSE-SU-2022:0570-1SUSE-SU-2022:0569-1

  • nodejs14 openSUSE Leap 15.3 14.19.0-15.27.1
  • nodejs8 openSUSE Leap 15.3 8.17.0-10.19.2
  • nodejs12 openSUSE Leap 15.3 12.22.10-4.29.3

opensuse advisories openSUSE-SU-2022:0715-1openSUSE-SU-2022:0704-1openSUSE-SU-2022:0657-1

  • nodejs-nodemon AlmaLinux 8 2.0.3-1.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.5.0+254+b4526b16
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762
  • npm AlmaLinux 8 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
  • npm AlmaLinux 8 1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
  • nodejs AlmaLinux 8 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
  • nodejs AlmaLinux 8 1:12.22.5-1.module_el8.5.0+85+79a7b441
  • nodejs-full-i18n AlmaLinux 8 1:12.22.5-1.module_el8.5.0+85+79a7b441

almalinux advisories ALSA-2021:3666ALSA-2021:3623

  • nodejs Rocky Linux 8 1:14.17.5-1.module+el8.4.0+654+17ff1d38
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.6.0+982+9fdca2d4
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.3.0+100+234774f7
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.4.0+638+5344c6f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c
  • nodejs Rocky Linux 8 1:12.22.5-1.module+el8.4.0+647+e905fa21

rocky linux advisories RLSA-2021:3666RLSA-2021:3623

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-23343 updated cvss 5.3

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

  • Red Hat OpenShift Service Mesh 1 kiali, servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Service Mesh 2.0 kiali, servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8, rhacm2/search-ui-rhel8, rhacm2/console-ui-rhel8, application-ui-container, rhacm2/mcm-topology-rhel8, rhacm2/console-header-rhel8, +2 more
    affected: no fix available “Fix deferred”
  • Red Hat Decision Manager 7 nodejs-path-parse Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-grafana, openshift4/ose-thanos-rhel9, openshift4/ose-metering-hadoop, openshift4/ose-prometheus-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    affected: no fix available
  • Red Hat Process Automation 7 nodejs-path-parse
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix available “Fix deferred”
show 9 more
  • Red Hat Software Collections rh-nodejs10-npm, rh-nodejs10-nodejs
    affected: no fix planned “Out of support scope”
  • Red Hat Virtualization 4 ovirt-web-ui
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 12.22.5-1.module+el8.4.0+12242+af52a4c7, nodejs 14.17.5-1.module+el8.4.0+12247+e2879e58, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.3-1.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.3-1.module+el8.4.0+11732+c668cc9f, +4 more
    fixed: vendor fix RHSA-2021:3623
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs 12.22.5-1.module+el8.1.0+12238+63fe3aec, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec, nodejs-full-i18n 12.22.5-1.module+el8.1.0+12238+63fe3aec
    fixed: vendor fix RHSA-2021:3639
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs 12.22.5-1.module+el8.2.0+12241+a3db445b, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b, nodejs-full-i18n 12.22.5-1.module+el8.2.0+12241+a3db445b
    fixed: vendor fix RHSA-2021:3638
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7
    fixed: vendor fix RHSA-2021:3281
  • Red Hat RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator 3.67.0-3
    fixed: vendor fix RHSA-2021:4902
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-ui-extensions 1.2.7-1.el8ev
    fixed: vendor fix RHSA-2021:2865
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/grc-ui-api-rhel8, rhacm2/search-api-rhel8, rhacm2/console-api-rhel8 Red Hat Ansible Automation Platform 1.2 path-parse Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7
    +3 more products
    Red Hat Virtualization 4 cockpit-ovirt-uiplugin, cockpit-ovirt-dashboard Red Hat RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-operator-bundle 3.67.0-2 Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.4.7.6-0.11.el8ev, ovirt-web-ui 1.7.0-1.el8ev, ovirt-engine 4.4.7.6-0.11.el8ev, rhvm-branding-rhv 4.4.9-1.el8ev, ovirt-engine-dwh 4.4.7.3-1.el8ev, ovirt-engine-setup 4.4.7.6-0.11.el8ev, +22 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.22% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • snyk.io https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067 referenced PoC, tagged "exploit" by a source, unverified
  • snyk.io https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/jbgutierrez/path-parse/issues/8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
npm path-parse
<1.0.7
1.0.7

Affected products

  • n/a path-parse

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.