CVE-2021-35065
Aliases:GHSA-cj88-88mr-972wBIT-gulp-2021-35065
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 26 Dec 2022, 00:00
Last modified:14 Apr 2025, 18:31
Vulnerability Summary
Overall Risk (default)
medium
40/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.42% LOW
0% probability -0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected
Timeline
26 Dec 2022, 00:00
Published
Vulnerability first disclosed
14 Apr 2025, 18:31
Last Modified
Vulnerability information updated
Description
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.42%• Percentile: 62%
Techniques & Countermeasures
- CWE-1333•Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Systems
- gulpjs•glob-parent
≥ 6.0.0, < 6.0.1
- Npm•glob-parent
≥ 6.0.0, < 6.0.1
References (11)
- https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
- https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
- https://github.com/gulpjs/glob-parent/pull/49
- https://security.netapp.com/advisory/ntap-20230214-0010/
- https://nvd.nist.gov/vuln/detail/CVE-2021-35065
- https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103
- https://github.com/gulpjs/glob-parent/commit/32f6d52663b7addac38d0dff570d8127edf03f47
- https://github.com/gulpjs/glob-parent
- https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1
- https://security.netapp.com/advisory/ntap-20230214-0010
- https://www.mend.io/vulnerability-database/CVE-2021-35065