What’s Vulnerable › Vulnerabilities

CVE-2020-28469: Regular Expression Denial of Service (ReDoS)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-03 · updated 2026-06-17
• Weakness: CWE-400

Description

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Affected products

• Gulpjs Glob-Parent: before 5.1.2 — fixed in 5.1.2
• Oracle Communications Cloud Native Core Policy: 1.14.0
• Npm Glob-Parent: from 4.0.0 before 5.1.2 — fixed in 5.1.2

How to fix

Upgrade to a fixed version: Gulpjs Glob-Parent 5.1.2; Npm Glob-Parent 5.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9
• https://github.com/gulpjs/glob-parent/pull/36
• https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092
• https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9
• https://github.com/gulpjs/glob-parent/pull/36
• https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092

Get alerted when CVE-2020-28469 or the next vulnerability affects your stack