Executive brief
parse-duration is a JavaScript library used to parse duration strings into milliseconds. A vulnerability in its regular expression allows attackers to cause event loop delays of up to 50ms or exhaust application memory by submitting specially crafted input strings. This can degrade application performance or crash Node.js services.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in parse-duration's regex pattern for parsing duration strings. The affected regex has catastrophic backtracking behavior when processing certain input patterns, particularly those with repeated characters and numeric exponents. An attacker can send crafted input strings—ranging from a few MB to tens of MB with Unicode characters—to either cause significant CPU-bound event loop delays (0.5–50ms per operation) or trigger out-of-memory conditions that crash the Node.js process. The attack requires no authentication and is triggered via normal library usage. Patches are available in version 2.1.3 and later.
Affected products
- parse-duration parse-duration < 2.1.3
Timeline
- 2025-02-12: disclosed
- 2025-02-12: patched: Fixed in version 2.1.3