{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "2.1.3"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9e88421bfd41806fa4b473bfb28a9ee9dafc27d7"
            },
            {
              "fixed": "92bb91f111a57604c2b8c72373f605c1cdf1f895"
            }
          ],
          "repo": "https://github.com/jkroso/parse-duration",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-hcrg-fc28-fcg5"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25283.json"
  },
  "details": "parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch.",
  "id": "CVE-2025-25283",
  "modified": "2026-07-15T01:48:51.170356124Z",
  "published": "2025-02-12T18:21:48.693Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jkroso/parse-duration/releases/tag/v2.1.3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25283.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25283"
    },
    {
      "type": "FIX",
      "url": "https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory"
}