CVE-2025-25283 parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory
Attackers can cause denial of service in Node.js applications using parse-duration by triggering excessive CPU usage and memory exhaustion via crafted input strings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25283?
CVE-2025-25283 is a high-severity denial of service vulnerability in jkroso parse-duration, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch.
Weakness: CWE-1333
Which versions are affected by CVE-2025-25283?
2 open source packages ship an affected version, including parse-duration.
| Package | Affected | Fixed in |
|---|---|---|
parse-duration npm | All versions | 2.1.3 |
parse-duration npm | All versions | 2.1.3 |
How do I fix CVE-2025-25283?
Upgrade parse-duration to 2.1.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-25283 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25283 exists.
Sources
Also known as GHSA-hcrg-fc28-fcg5.