Regular Expression Denial of Service in Node.js 4.x Path Module

CVE-2018-7158

What is CVE-2018-7158?

The path module in Node.js 4.x versions contains a vulnerability that allows for a regular expression denial of service (ReDoS) due to poorly structured regex patterns. Specifically, the vulnerable regex splitPathRe used in functions like path.dirname(), path.extname(), and path.parse() can be exploited by attackers who submit specially crafted strings as input. These inputs can provoke extensive evaluation times, leading to significant service delays or even complete denial of service. This issue has been addressed in Node.js 6.x and later versions.

References