High, CVSS 7.5npmAmendedPublished
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
CVE-2025-25283 · GHSA-hcrg-fc28-fcg5
- Affected
- npm parse-duration < 2.1.3
- Fixed in
- 2.1.3· Vendor fix available
- Issue
- This report finds 2 availability issues due to the regex used in the parse-duration npm package: 1. An event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively. 2. An out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. PoC Refer to the following proof of concept code that provides a test case and makes use of the regular expression in the library as its test case to match against strings: The results of this on the cloud machine that I ran this on are as follows: You can note that: 1. 0.01 MB of input was enough to cause a 1ms delay (0.92ms) 2. Ranging from either 3 MB to 4 MB of input results in almost a full second day (728ms) and 42 ms, depending on the characters used in the text passed to the library's parse() function 3. A 200 MB of input size already…
Recommended action: Upgrade to 2.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.