PT-2022-10388 · Npm+5 · Glob-Parent+5

Trott · Published 2022-07-18 · Updated 2025-12-19 · CVE-2021-35065

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions glob-parent versions prior to 6.0.1

Description The issue allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression in the glob-parent package for Node.js.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 to resolve the issue. As a temporary workaround, consider restricting the use of regular expressions in the enclosure until the update is applied.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

ALSA-2023:1582

ALSA-2023:1583

ALSA-2023:1743

ALSA-2023:2654

BIT-GULP-2021-35065

CESA-2023_1582

CESA-2023_1583

CESA-2023_1743

CVE-2021-35065

GHSA-CJ88-88MR-972W

RHSA-2023:0612

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

RHSA-2023:1533

RHSA-2023:1582

RHSA-2023:1583

RHSA-2023:1742

RHSA-2023:1743

RHSA-2023:2654

RHSA-2023:2655

RHSA-2023_1582

RHSA-2023_1583

RHSA-2023_1743

RHSA-2023_2654

RHSA-2023_2655

RLSA-2023:1582

RLSA-2023:1583

RLSA-2023:1743

Affected Products

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Glob-Parent

References · 78

• 🔥 https://github.com/gulpjs/glob-parent/pull/49 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294 · Exploit
• https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339 · Patch
• https://osv.dev/vulnerability/ALSA-2023:1583 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35065 · Security Note
• https://osv.dev/vulnerability/GHSA-cj88-88mr-972w · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-1582.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:1582 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-35065 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:1582 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35065 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:1582 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-1583.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:1583 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-35065 · Vendor Advisory