UpHeron
All vulnerabilities

Servers and applications

CVE-2018-7158

The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`,…

Severity
High 7.5
Published
17 May 2018
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 4.0.0 up to 4.1.2
  • From 4.2.0 up to 4.9.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-7158
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-7158