CVE-2025-5891 in pm2
Summary
by MITRE • 06/09/2025
A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability in Unitech pm2 version 6.0.6 represents a critical security flaw that resides within the configuration handling mechanism of the process manager. The issue is specifically located in the /lib/tools/Config.js file where inefficient regular expression complexity has been identified, creating a potential pathway for malicious actors to exploit the system. This type of vulnerability falls under the category of regular expression denial of service attacks, which can cause significant performance degradation and potentially system compromise when exploited.
The technical flaw manifests through the use of poorly constructed regular expressions that exhibit exponential time complexity during pattern matching operations. When an attacker crafts malicious input that triggers these inefficient regex patterns, the system experiences dramatic performance degradation as the regular expression engine struggles to process the input. This vulnerability is particularly dangerous because it can be initiated remotely without requiring any authentication or privileged access, making it highly accessible to attackers. The exploitation involves sending specially crafted input through network requests that cause the pm2 process to spend excessive computational resources processing the regular expressions.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially enable more sophisticated attacks. Attackers can leverage this weakness to consume system resources and potentially cause denial of service conditions, which could disrupt critical applications managed by pm2. The fact that this vulnerability has been publicly disclosed and is known to be exploitable means that threat actors are actively targeting systems running affected versions. This creates an immediate risk for organizations that have not yet patched their pm2 installations, as the attack surface remains open for exploitation.
Security professionals should implement immediate mitigation strategies including updating to the latest stable version of pm2 where this vulnerability has been addressed. Organizations must also consider implementing input validation and sanitization measures to reduce the impact of potential attacks. The vulnerability aligns with CWE-400 which specifically addresses "Uncontrolled Resource Consumption" and relates to ATT&CK technique T1496 for resource exhaustion attacks. Additionally, organizations should monitor network traffic for patterns that might indicate exploitation attempts and consider implementing rate limiting mechanisms to prevent abuse of the affected functionality. Regular security assessments and vulnerability scanning should be conducted to identify similar issues in other components of the application stack.