Executive brief
path-parse is a Node.js library used to parse file paths in JavaScript applications. A regular expression denial of service (ReDoS) vulnerability in the library's path-parsing logic allows an attacker to cause excessive CPU consumption and application hangs by providing specially crafted invalid paths. This can result in service unavailability and denial of service attacks against applications that process untrusted file paths.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting the splitDeviceRe, splitTailRe, and splitPathRe regular expressions in path-parse. The regexes exhibit polynomial worst-case time complexity when processing adversarial input. An attacker can craft pathological strings (e.g., many consecutive forward slashes followed by a non-ASCII character) that cause exponential backtracking in the regex engine. No authentication is required; the attack is triggered by calling the library's main parsing function with a malicious string. The impact is denial of service through CPU exhaustion. A fix was released in version 1.0.7, which addresses the regex patterns.
Affected products
- npm path-parse before 1.0.7
Timeline
- 2021-02-09: disclosed: Vulnerability reported via GitHub issue #8
- 2021: patched: Fixed in version 1.0.7
- 2021-08-10: advisory: GitHub security advisory published
- 2021-05-04: other: NVD published CVE-2021-23343