PT-2025-7066 · Node.Js+1 · Node.Js+1

Lirantal · Published 2025-02-12 · Updated 2025-02-12 · CVE-2025-25283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: parse-duraton versions prior to 2.1.3

Description: The issue is related to an event loop delay due to the CPU-bound operation of resolving the provided string, which can range from 0.5ms to ~50ms per operation, depending on the size of the input string, which can vary from 0.01 MB to 4.3 MB. Additionally, an out of memory issue can occur due to a string size of roughly 10 MB that utilizes unicode characters, causing a Node.js application to crash. The parse() function in the library is vulnerable to this issue, particularly when using the replace() function, which creates copies of the input in memory.

Recommendations: For versions prior to 2.1.3, update to version 2.1.3, which contains a patch for this issue. As a temporary workaround, consider restricting the size of input strings to prevent excessive delays and out of memory issues. Additionally, implementing rate limits on concurrent requests can help mitigate the impact of this issue on application performance.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2025-25283

GHSA-HCRG-FC28-FCG5

Affected Products

Node.Js

Parse Duration

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25283.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-25283 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcrg-fc28-fcg5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25283 · Security Note
• https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7 · Note
• https://github.com/jkroso/parse-duration/releases/tag/v2.1.3 · Note
• https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5 · Note
• https://github.com/jkroso/parse-duration · Note
• https://t.me/cvedetector/17928 · Telegram Post
• https://twitter.com/CVEnew/status/1889761633288986781 · Twitter Post