4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5891

CVE-2025-5891: pm2 Regular Expression Denial of Service vulnerability

A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5891

CVE-2025-5891:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pm2	npm	<= 6.0.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) in Unitech/pm2 specifically within the lib/tools/Config.js file. Direct access to commit information or file content via GitHub API tools failed due to authentication issues. However, a publicly available proof-of-concept (POC) from https://gist.github.com/mmmsssttt404/407e2ffe3e0eaa393ad923a86316a385 clearly demonstrates the vulnerability. The POC imports the Config.js module (implicitly lib/tools/Config.js based on the vulnerability description) and calls the _valid function with a malicious input string (value = "" + "a".repeat(100000) + "=";). This input is designed to cause excessive backtracking in a poorly constructed regular expression within the _valid function, leading to high CPU usage and a denial of service, which is confirmed by the POC's timing mechanism. The vulnerability description corroborates that the issue lies in lib/tools/Config.js and involves inefficient regular expression complexity. Therefore, the _valid function is identified as the vulnerable function that processes the malicious input and triggers the ReDoS condition. The function signature would be _valid as it's a method of the config object, which is an instance of the module exported by Config.js.

Root Cause: The root cause is an inefficient regular expression within the _valid function in lib/tools/Config.js. This regex exhibits catastrophic backtracking when processing certain patterns, particularly long sequences of characters like the one used in the POC. This leads to excessive CPU consumption, effectively denying service to other operations or users of the pm2 process manager.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.