CVE-2021-23343: Path-Parse Project Path-Parse

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Affected products

• Path-Parse Project Path-Parse: before 1.0.7 (fixed in 1.0.7)

Published 2021-05-04. Last modified 2026-06-17.