CVE-2018-7158
First published: Thu May 17 2018(Updated: )
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
Credit: cve-request@iojs.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Langgenius Dify Node.js | >=4.0.0<=4.1.2 | |
| Langgenius Dify Node.js | >=4.2.0<=4.9.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2018-7158?
CVE-2018-7158 is classified as a moderate vulnerability due to its potential for regular expression denial of service (ReDoS) attacks.
Which versions of Node.js are affected by CVE-2018-7158?
CVE-2018-7158 affects all versions of Node.js 4.x, specifically from 4.0.0 to 4.9.1.
How do I fix CVE-2018-7158?
To fix CVE-2018-7158, upgrade to Node.js version 6.x or later, where the vulnerable code has been replaced.
What kind of attack does CVE-2018-7158 facilitate?
CVE-2018-7158 facilitates a regular expression denial of service (ReDoS) attack, which can exhaust system resources.
Is there a workaround for CVE-2018-7158 if immediate upgrade is not possible?
There is no specific workaround for CVE-2018-7158; upgrading to a secure version is the recommended mitigation.
- agent/type
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/nodejs
- canonical/langgenius dify node.js
- version/langgenius dify node.js/4.0.0
- version/langgenius dify node.js/4.1.2
- version/langgenius dify node.js/4.2.0
- version/langgenius dify node.js/4.9.1