CVE-2024-36751: parse-uri Regular expression Denial of Service (ReDoS)
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.21158%
CWE
Published
1/16/2025
Updated
2/3/2025
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-uri | npm | <= 1.0.9 | |
| parseuri | npm | < 2.0.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The GitHub issue #14 explicitly references vulnerable regex patterns in parse-uri's index.js lines 28-29 used by the parseUri function. The PoC demonstrates ReDoS through this function. For parseuri package (<2.0.0), the advisory links it to the same CVE but lacks direct code references - the medium confidence comes from package similarity and shared vulnerability description. Both CWEs (185/1333) indicate regex implementation flaws as the root cause.