parse-duration has a Regex Denial of Service that results in event loop delay and out of memory

Description

This report finds 2 availability issues due to the regex used in the parse-duration npm package:

1. An event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively.
2. An out of memory that would crash a running Node.

Recommendation

Update the parse-duration package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.3
• Patched version(s): 2.1.3

References

• GHSA-hcrg-fc28-fcg5
• CVE-2025-25283
• CWE-1333
• CAPEC-310
• OWASP 2021-A6