CVE-2020-28469: Regular Expression Denial of Service (ReDoS)
A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent function. The highest threat from this vulnerability is to system availability.
Other sources
Node.js glob-parent module is vulnerable to a denial of service. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a regular expression denial of service.
— IBM
The enclosure regex used to check for glob enclosures containing backslash is vulnerable to Regular Expression Denial of Service attacks. An attacker can use this flaw to cause a denial of service if they can supply a malicious string to the glob-parent function.
— Red Hat
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-28469?
CVE-2020-28469 is a vulnerability in the package glob-parent before version 5.1.2. It is susceptible to Regular Expression Denial of Service (ReDoS) attacks.
How does CVE-2020-28469 impact the nodejs-glob-parent package?
CVE-2020-28469 allows an attacker to cause a denial of service by supplying a malicious string to the glob-parent function.
What is the severity of CVE-2020-28469?
CVE-2020-28469 has a severity rating of 7.5 (high).
How can I fix CVE-2020-28469?
To fix CVE-2020-28469, update the glob-parent package to version 5.1.2 or higher.
Where can I find more information about CVE-2020-28469?
You can find more information about CVE-2020-28469 at the following references: [CVE-2020-28469](https://www.cve.org/CVERecord?id=CVE-2020-28469), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-28469), [Snyk](https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1945459), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2021:3016).