Every CVE Search/ Get API key

CVE-2020-28469

Regular Expression Denial of Service (ReDoS)

5.3 MediumFix available

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

4.58%Up 3.1 points since Jun 4, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.3

Regular Expression Denial of Service (ReDoS)

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
CVE-2020-28469
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
EUVDEUVD-2021-1421 5.3

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
EUVD-2021-1421
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-ww39-953v-wcq6 7.5

glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
GHSA-ww39-953v-wcq6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 5.3

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
CVE-2020-28469
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400
Updated
2026-11-02
OSVAZL-44118 7.5

CVE-2020-28469 affecting package nodejs-nodemon 2.0.3-5

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
AZL-44118
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-44862 7.5

CVE-2020-28469 affecting package js-jquery 3.5.0-4

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
AZL-44862
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 19 moreShow less
OSV 7.5

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
CVE-2020-28469
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-28469 7.5

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
DEBIAN-CVE-2020-28469
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-ww39-953v-wcq6 7.5

glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
GHSA-ww39-953v-wcq6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVRHSA-2021:2865 7.5

Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.7]

Record
RHSA-2021:2865
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3280 9.8

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record
RHSA-2021:3280
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3281 9.8

Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update

Record
RHSA-2021:3281
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4626 7.5

Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.9]

Record
RHSA-2021:4626
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:5171 9.8

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Record
RHSA-2021:5171
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0246 9.8

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2022:0246
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0350 9.8

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2022:0350
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:6595 7.5

Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update

Record
RHSA-2022:6595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:5171 9.8

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:5171
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:0350 9.8

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0350
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:6595 7.5

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)

  • nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  • nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  • nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  • nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  • got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)

  • nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

Record
RLSA-2022:6595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2021:5171 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:5171
Updated
2026-11-02
OSVALSA-2022:0350 No score

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:0350
Updated
2026-11-02
OSVALSA-2022:6595 No score

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
  • normalize-url: ReDoS for data URLs (CVE-2021-33502)
  • nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)
  • nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
  • nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
  • nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
  • nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
  • got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)
  • nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)
Record
ALSA-2022:6595
Updated
2026-11-02
OSVBIT-gulp-2020-28469 No score

Regular Expression Denial of Service (ReDoS)

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Record
BIT-gulp-2020-28469
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2020-28469 No score

CVE-2020-28469 in glob-parent - Patched by Root

Root has patched CVE-2020-28469 in the glob-parent package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2020-28469
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glob-parent
npm
 4.0.0 up to 5.1.2
5.1.2
nodejs
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
nodejs
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-devel
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
nodejs-devel
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-docs
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
nodejs-docs
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-full-i18n
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
nodejs-full-i18n
AlmaLinux:8
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-nodemon
AlmaLinux:8
 before 2.0.15-1.module_el8.6.0+2904+f21ad6f4
2.0.15-1.module_el8.6.0+2904+f21ad6f4
Show 91 moreShow less
Affected packages
PackageAffectedFixed
nodejs-nodemon
AlmaLinux:8
 before 2.0.15-1.module_el8.5.0+2605+45d748af
2.0.15-1.module_el8.5.0+2605+45d748af
nodejs-packaging
AlmaLinux:8
 before 25-1.module_el8.5.0+246+05401605
25-1.module_el8.5.0+246+05401605
nodejs-packaging
AlmaLinux:8
 before 25-1.module_el8.5.0+2605+45d748af
25-1.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
 before 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af
1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
 before 1:8.1.2-1.16.13.1.3.module_el8.5.0+246+05401605
1:8.1.2-1.16.13.1.3.module_el8.5.0+246+05401605
nodejs
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-devel
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-devel
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-docs
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-docs
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-full-i18n
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-full-i18n
AlmaLinux:8
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-nodemon
AlmaLinux:8
 before 2.0.15-1.module_el8.5.0+2618+8d46dafd
2.0.15-1.module_el8.5.0+2618+8d46dafd
nodejs-packaging
AlmaLinux:8
 before 23-3.module_el8.5.0+2618+8d46dafd
23-3.module_el8.5.0+2618+8d46dafd
nodejs-packaging
AlmaLinux:8
 before 23-3.module_el8.4.0+2522+3bd42762
23-3.module_el8.4.0+2522+3bd42762
npm
AlmaLinux:8
 before 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
npm
AlmaLinux:8
 before 1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
nodejs
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-docs
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-full-i18n
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-nodemon
AlmaLinux:9
 before 2.0.19-1.el9_0
2.0.19-1.el9_0
npm
AlmaLinux:9
 before 1:8.11.0-1.16.16.0.1.el9_0
1:8.11.0-1.16.16.0.1.el9_0
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
gulp
Bitnami
 before 5.1.2
5.1.2
node-glob-parent
Debian:12
 before 5.1.1+~5.1.0-2
5.1.1+~5.1.0-2
node-glob-parent
Debian:13
 before 5.1.1+~5.1.0-2
5.1.1+~5.1.0-2
node-glob-parent
Debian:14
 before 5.1.1+~5.1.0-2
5.1.1+~5.1.0-2
ovirt-engine-ui-extensions
Red Hat:rhev_manager:4.4:el8
 before 0:1.2.7-1.el8ev
0:1.2.7-1.el8ev
rh-nodejs14-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
 before 0:2.0.3-5.el7
0:2.0.3-5.el7
rh-nodejs14-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.14.14-14.17.5.1.el7
0:6.14.14-14.17.5.1.el7
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
 before 0:2.0.3-5.el7
0:2.0.3-5.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.14.14-12.22.5.1.el7
0:6.14.14-12.22.5.1.el7
ovirt-web-ui
Red Hat:rhev_manager:4.4:el8
 before 0:1.7.2-1.el8ev
0:1.7.2-1.el8ev
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.15-1.module+el8.5.0+13548+45d748af
0:2.0.15-1.module+el8.5.0+13548+45d748af
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:25-1.module+el8.5.0+10992+fac5fe06
0:25-1.module+el8.5.0+10992+fac5fe06
npm
Red Hat:enterprise_linux:8::appstream
 before 1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af
1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af
nodejs
Red Hat:rhel_eus:8.4::appstream
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-debuginfo
Red Hat:rhel_eus:8.4::appstream
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-debugsource
Red Hat:rhel_eus:8.4::appstream
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-devel
Red Hat:rhel_eus:8.4::appstream
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-docs
Red Hat:rhel_eus:8.4::appstream
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-full-i18n
Red Hat:rhel_eus:8.4::appstream
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-nodemon
Red Hat:rhel_eus:8.4::appstream
 before 0:2.0.15-1.module+el8.4.0+13503+fc29810b
0:2.0.15-1.module+el8.4.0+13503+fc29810b
nodejs-packaging
Red Hat:rhel_eus:8.4::appstream
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:rhel_eus:8.4::appstream
 before 1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22
1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.15-1.module+el8.5.0+13504+a2e74d91
0:2.0.15-1.module+el8.5.0+13504+a2e74d91
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:enterprise_linux:8::appstream
 before 1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:2.0.19-1.el9_0
0:2.0.19-1.el9_0
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
npm
Red Hat:enterprise_linux:9::appstream
 before 1:8.11.0-1.16.16.0.1.el9_0
1:8.11.0-1.16.16.0.1.el9_0
nodejs
Rocky Linux:8
 before 1:16.13.1-3.module+el8.5.0+721+4c107270
1:16.13.1-3.module+el8.5.0+721+4c107270
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.15-1.module+el8.5.0+721+4c107270
0:2.0.15-1.module+el8.5.0+721+4c107270
nodejs-packaging
Rocky Linux:8
 before 0:25-1.module+el8.6.0+1046+80feca58
0:25-1.module+el8.6.0+1046+80feca58
nodejs-packaging
Rocky Linux:8
 before 0:25-1.module+el8.5.0+702+221f14e6
0:25-1.module+el8.5.0+702+221f14e6
nodejs
Rocky Linux:8
 before 1:14.18.2-2.module+el8.5.0+733+de4fee6c
1:14.18.2-2.module+el8.5.0+733+de4fee6c
nodejs-packaging
Rocky Linux:8
 before 0:23-3.module+el8.7.0+1071+4bdda2a8
0:23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging
Rocky Linux:8
 before 0:23-3.module+el8.3.0+100+234774f7
0:23-3.module+el8.3.0+100+234774f7
nodejs-packaging
Rocky Linux:8
 before 0:23-3.module+el8.5.0+733+de4fee6c
0:23-3.module+el8.5.0+733+de4fee6c
nodejs-nodemon
Rocky Linux:9
 before 0:2.0.19-1.el9_0
0:2.0.19-1.el9_0
glob-parent
Root:npm
 before 5.1.1-aikido.1
5.1.1-aikido.1
@rootio/glob-parent
Root:npm
 before 5.1.1-root.io.1
5.1.1-root.io.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-28469 is a medium vulnerability (CVSS 5.3) in Gulpjs Glob-parent, published June 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.58%, the 91st percentile. Fixed in glob-parent 5.1.2.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 11 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open