Regular Expression Denial of Service in Node.js 4.x Path Module

CVE-2018-7158

What is CVE-2018-7158?

The path module in Node.js 4.x versions contains a vulnerability that allows for a regular expression denial of service (ReDoS) due to poorly structured regex patterns. Specifically, the vulnerable regex splitPathRe used in functions like path.dirname(), path.extname(), and path.parse() can be exploited by attackers who submit specially crafted strings as input. These inputs can provoke extensive evaluation times, leading to significant service delays or even complete denial of service. This issue has been addressed in Node.js 6.x and later versions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References