Skip to content
Fencer Vulns
high 7.5

CVE-2021-35065 json

glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

published 2022-07-18 4 y ago modified 2026-09-08 2 mo ago also BIT-gulp-2021-35065 , EUVD-2022-6318 , GHSA-cj88-88mr-972w

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

Patch / fix

  • npm glob-parent 6.0.1
  • bitnami gulp 6.0.1
  • gulpjs glob-parent 6.0.1
  • node-glob-parent Debian 14, Debian 13, Debian 12 6.0.2+~5.1.1-1

debian advisories DEBIAN-CVE-2021-35065

  • npm RHEL 9 1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c
  • nodejs RHEL 9 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
  • nodejs-nodemon RHEL 9 2.0.20-2.module+el9.2.0.z+18497+a402347c
  • nodejs-full-i18n RHEL 9 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
  • nodejs-packaging RHEL 9 2021.06-4.module+el9.1.0+15718+e52ec601
  • nodejs-packaging-bundler RHEL 9 2021.06-4.module+el9.1.0+15718+e52ec601
  • npm RHEL 8 1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea
  • nodejs RHEL 8 1:18.14.2-2.module+el8.7.0+18445+9493b6ea

red hat advisories RHSA-2023:2654RHSA-2023:1583RHSA-2023:1582RHSA-2023:1743RHSA-2023:1742RHSA-2023:1533

  • npm AlmaLinux 9 1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b
  • nodejs AlmaLinux 9 1:18.14.2-2.module_el9.2.0+29+de583a0b
  • nodejs-nodemon AlmaLinux 9 2.0.20-2.module_el9.2.0+29+de583a0b
  • nodejs-full-i18n AlmaLinux 9 1:18.14.2-2.module_el9.2.0+29+de583a0b
  • nodejs-packaging AlmaLinux 9 2021.06-4.module_el9.1.0+13+d9a595ea
  • nodejs-packaging-bundler AlmaLinux 9 2021.06-4.module_el9.1.0+13+d9a595ea
  • npm AlmaLinux 8 1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8
  • nodejs AlmaLinux 8 1:14.21.3-1.module_el8.7.0+3551+53700ee8

almalinux advisories ALSA-2023:2654ALSA-2023:1743ALSA-2023:1582ALSA-2023:1583

  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40025+0e0cf6b2
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40017+f0db1785
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40018+a011993d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40022+9ecc286c
  • nodejs Rocky Linux 8 1:14.21.3-1.module+el8.7.0+1183+c2c35f0a
  • nodejs-nodemon Rocky Linux 8 2.0.20-3.module+el8.7.0+1178+d52dba78
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs Rocky Linux 8 1:16.19.1-1.module+el8.7.0+1178+d52dba78

rocky linux advisories RLSA-2023:2654RLSA-2023:1743RLSA-2023:1582RLSA-2023:1583

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-35065 updated cvss 7.5

glob-parent: Regular Expression Denial of Service

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8 Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, servicemesh-prometheus, openshift-service-mesh/kiali-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat A-MQ Online glob-parent
    affected: no fix planned “Out of support scope”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 aap-azure-ui
    affected: no fix planned “Will not fix”
  • Red Hat build of Apache Camel for Spring Boot 3 glob-parent
    affected: no fix available “Fix deferred”
  • Red Hat Decision Manager 7 glob-parent
    affected: no fix planned “Out of support scope”
  • Red Hat Discovery 1 discovery-server-container
    affected: no fix planned “Will not fix”
show 23 more
  • Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat Enterprise Linux 9 gjs, pcs, pcs-snmp
    affected: no fix planned “Will not fix”
  • Red Hat Fuse 7 glob-parent Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel8
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces-theia-endpoint-rhel8-container
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin
    affected: no fix available
  • Red Hat Process Automation 7 glob-parent
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
  • Red Hat MTA 6.0 for RHEL 8 mta/mta-ui-rhel8 6.0.1-10
    fixed: vendor fix RHSA-2023:0934
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.21.3-1.module+el8.7.0+18531+81d21ca6, nodejs 16.19.1-1.module+el8.7.0+18373+704f5cef, nodejs 18.14.2-2.module+el8.7.0+18445+9493b6ea, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea, +10 more
    fixed: vendor fix RHSA-2023:1743
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.19.1-1.el9_2, nodejs-libs 16.19.1-1.el9_2, npm 8.19.3-1.16.19.1.1.el9_2, nodejs-nodemon 2.0.20-3.el9_2, nodejs-full-i18n 16.19.1-1.el9_2, nodejs 18.14.2-2.module+el9.2.0.z+18497+a402347c, +5 more
    fixed: vendor fix RHSA-2023:2655
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.21.3-1.module+el8.4.0+18317+43f5ac16, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.4.0+18317+43f5ac16, npm 6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16, nodejs-full-i18n 14.21.3-1.module+el8.4.0+18317+43f5ac16
    fixed: vendor fix RHSA-2023:1533
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 14.21.3-1.module+el8.6.0+18532+cbe6f646, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.6.0+18532+cbe6f646, npm 6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646, nodejs-full-i18n 14.21.3-1.module+el8.6.0+18532+cbe6f646
    fixed: vendor fix RHSA-2023:1742
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 devspaces 3.24-1760713657
    fixed: vendor fix RHSA-2025:19094
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs14-nodejs-nodemon 2.0.20-2.el7, rh-nodejs14-nodejs-full-i18n 14.21.1-3.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs14-nodejs-nodemon 2.0.20-2.el7, rh-nodejs14-nodejs-full-i18n 14.21.1-3.el7
    fixed: vendor fix RHSA-2023:0612
  • Red Hat RHOL 5.6 for RHEL 8 openshift-logging/logging-view-plugin-rhel8 v5.6.1-8
    fixed: vendor fix RHSA-2023:0634
  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat MTA 6.0 for RHEL 8 mta/mta-hub-rhel8 6.0.1-8, mta/mta-pathfinder-rhel8 6.0.1-6, mta/mta-admin-addon-rhel8 6.0.1-8, mta/mta-windup-addon-rhel8 6.0.1-9
    not affected: vulnerable code not present

15 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.70% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/gulpjs/glob-parent/pull/49 referenced PoC, tagged "exploit" by a source, unverified
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm glob-parent
>=6.0.0, <6.0.1
6.0.1
bitnami gulp
>=6.0.0, <6.0.1
6.0.1

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.