parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
- Severity:
- High
Description
This report finds 2 availability issues due to the regex used in the parse-duration npm package:
- An event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively.
- An out of memory that would crash a running Node.
Recommendation
Update the parse-duration package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.1.3
- Patched version(s): 2.1.3
References
Related Issues
- youtube-regex vulnerable to Regex Denial of Service - CVE-2025-65122
- string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143
- @mozilla/readability Denial of Service through Regex - CVE-2025-2792
- @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - CVE-2025-25285
You might also like:
- Tags:
- npm
- parse-duration
Anything's wrong? Let us know Last updated on February 12, 2025