CVE-2024-36751: parse-uri Regular expression Denial of Service (ReDoS)

January 16, 2025 (updated October 31, 2025)

An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.

References

gist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233
github.com/Kikobeats/parse-uri/issues/14
github.com/advisories/GHSA-6fx8-h7jm-663j
nvd.nist.gov/vuln/detail/CVE-2024-36751

Code Behaviors & Features

Detect and mitigate CVE-2024-36751 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →