{"action":"Upgrade parse-duration to 2.1.3 or later.","affected":[{"fixed":"2.1.3","introduced":"0"}],"component":"parse-duration","cve_ids":["CVE-2025-25283"],"ecosystem":"npm","epss":0.00774,"exploited":false,"fixed_versions":["2.1.3"],"ghsa_id":"GHSA-hcrg-fc28-fcg5","id":"tcs_01M5KFTSPV8MM34ZASH856JY1K","modified_at":"2025-02-12T21:35:41Z","published_at":"2025-02-12T19:45:51Z","references":["https://osv.dev/vulnerability/GHSA-hcrg-fc28-fcg5","https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5","https://nvd.nist.gov/vuln/detail/CVE-2025-25283","https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7","https://github.com/jkroso/parse-duration","https://github.com/jkroso/parse-duration/releases/tag/v2.1.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-hcrg-fc28-fcg5","url":"https://osv.dev/vulnerability/GHSA-hcrg-fc28-fcg5"}],"summary":"parse-duration has a Regex Denial of Service that results in event loop delay and out of memory"}