Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vg7c-pctm-m7gn
Vulnerability ID VCID-vg7c-pctm-m7gn
Aliases CVE-2021-33502
GHSA-px4h-xg32-q955
Summary ReDoS in normalize-url The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-400 Uncontrolled Resource Consumption
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33502.json
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
epss 0.00464 https://api.first.org/data/v1/epss?cve=CVE-2021-33502
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-px4h-xg32-q955
cvssv3.1 7.5 https://github.com/sindresorhus/normalize-url
generic_textual HIGH https://github.com/sindresorhus/normalize-url
cvssv3.1 7.5 https://github.com/sindresorhus/normalize-url/commit/b1fdb5120b6d27a88400d8800e67ff5a22bd2103
generic_textual HIGH https://github.com/sindresorhus/normalize-url/commit/b1fdb5120b6d27a88400d8800e67ff5a22bd2103
cvssv3.1 7.5 https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1
generic_textual HIGH https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-33502
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-33502
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20210706-0001
generic_textual HIGH https://security.netapp.com/advisory/ntap-20210706-0001
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33502.json
https://api.first.org/data/v1/epss?cve=CVE-2021-33502
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
https://github.com/sindresorhus/normalize-url
https://github.com/sindresorhus/normalize-url/commit/b1fdb5120b6d27a88400d8800e67ff5a22bd2103
https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1
https://nvd.nist.gov/vuln/detail/CVE-2021-33502
https://security.netapp.com/advisory/ntap-20210706-0001
https://security.netapp.com/advisory/ntap-20210706-0001/
1964461 https://bugzilla.redhat.com/show_bug.cgi?id=1964461
989258 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989258
GHSA-px4h-xg32-q955 https://github.com/advisories/GHSA-px4h-xg32-q955
RHSA-2021:2931 https://access.redhat.com/errata/RHSA-2021:2931
RHSA-2021:2932 https://access.redhat.com/errata/RHSA-2021:2932
RHSA-2021:5171 https://access.redhat.com/errata/RHSA-2021:5171
RHSA-2022:0246 https://access.redhat.com/errata/RHSA-2022:0246
RHSA-2022:0350 https://access.redhat.com/errata/RHSA-2022:0350
RHSA-2022:4711 https://access.redhat.com/errata/RHSA-2022:4711
RHSA-2022:6595 https://access.redhat.com/errata/RHSA-2022:6595
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33502.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/sindresorhus/normalize-url
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/sindresorhus/normalize-url/commit/b1fdb5120b6d27a88400d8800e67ff5a22bd2103
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-33502
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20210706-0001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.57819
EPSS Score 0.00355
Published At April 13, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:02:20.198349+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-px4h-xg32-q955/GHSA-px4h-xg32-q955.json 38.0.0