CVE-2018-7158: High severity Nodejs Node.js vulnerability
The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, splitPathRe, used within the 'path' module for the various path parsing functions, including path.dirname(), path.extname() and path.parse() was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.x
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7158?
CVE-2018-7158 is classified as a moderate vulnerability due to its potential for regular expression denial of service (ReDoS) attacks.
Which versions of Node.js are affected by CVE-2018-7158?
CVE-2018-7158 affects all versions of Node.js 4.x, specifically from 4.0.0 to 4.9.1.
How do I fix CVE-2018-7158?
To fix CVE-2018-7158, upgrade to Node.js version 6.x or later, where the vulnerable code has been replaced.
What kind of attack does CVE-2018-7158 facilitate?
CVE-2018-7158 facilitates a regular expression denial of service (ReDoS) attack, which can exhaust system resources.
Is there a workaround for CVE-2018-7158 if immediate upgrade is not possible?
There is no specific workaround for CVE-2018-7158; upgrading to a secure version is the recommended mitigation.