CVE-2025-5891 Overview
CVE-2025-5891 affects Unitech pm2 versions up to 6.0.6, a widely deployed Node.js process manager. The vulnerability resides in /lib/tools/Config.js and stems from inefficient regular expression complexity [CWE-1333]. An attacker with low privileges can trigger excessive backtracking by supplying crafted input, causing the process to consume disproportionate CPU cycles. The flaw is remotely reachable and the exploit has been publicly disclosed, though no in-the-wild exploitation is confirmed. Because pm2 commonly runs production Node.js workloads, degraded availability of the process manager can cascade into service disruption for hosted applications.
Critical Impact
Remote attackers with low privileges can trigger a Regular Expression Denial of Service (ReDoS) condition against the pm2 configuration parser, degrading the availability of managed Node.js processes.
Affected Products
- Unitech pm2 versions up to and including 6.0.6
- Node.js applications managed by vulnerable pm2 instances
- Environments relying on /lib/tools/Config.js for configuration parsing
Discovery Timeline
- 2025-06-09 - CVE-2025-5891 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5891
Vulnerability Analysis
The vulnerability is an Algorithmic Complexity Attack rooted in a poorly constructed regular expression within pm2's configuration handling logic. When the affected regex processes attacker-controlled input, catastrophic backtracking occurs, forcing the Node.js event loop to spend excessive time on a single evaluation. Because Node.js is single-threaded, a stalled regex evaluation blocks all other operations in the pm2 daemon.
The issue is tracked under two Common Weakness Enumeration (CWE) identifiers: [CWE-400] Uncontrolled Resource Consumption and [CWE-1333] Inefficient Regular Expression Complexity. Attackers do not require code execution or file system access, and the network attack vector means any exposed interface parsing configuration data can serve as an entry point.
Root Cause
The regex pattern used inside /lib/tools/Config.js contains ambiguous quantifiers or overlapping groups that generate exponential state combinations for certain input strings. Node.js uses a backtracking regex engine, so pathological inputs cause CPU utilization to spike. The upstream fix is tracked in Unitech pm2 pull request #5971.
Attack Vector
Exploitation requires the attacker to submit crafted strings to any code path that funnels input through the vulnerable regex in Config.js. The attack is network-reachable and requires only low privileges. A public proof-of-concept exists as a GitHub Gist demonstrating the ReDoS pattern. The vulnerability does not compromise confidentiality or integrity; the impact is limited to availability.
No verified code examples are available for reproduction. See the VulDB entry #311662 and the linked proof-of-concept for technical details.
Detection Methods for CVE-2025-5891
Indicators of Compromise
- Sustained single-core CPU saturation by the pm2 or PM2 God Daemon process without proportional workload increase
- Unresponsive pm2 CLI commands (pm2 list, pm2 status) while the daemon is running
- Application health checks failing due to blocked event loop in the pm2 supervisor
- Log entries showing repeated configuration parsing requests with unusually long input strings
Detection Strategies
- Monitor pm2 daemon CPU utilization and flag sustained usage above baseline for anomaly review
- Inspect network-facing services or APIs that forward user-supplied strings into pm2 configuration parsing
- Correlate pm2 process performance degradation with recent inbound requests containing atypically long or repetitive character sequences
Monitoring Recommendations
- Enable process-level telemetry to track event-loop lag and CPU time per pm2 worker
- Alert on availability regressions in services supervised by pm2 that lack corresponding upstream failures
- Review web application firewall (WAF) logs for input strings exhibiting ReDoS-typical patterns such as long runs of a single character
How to Mitigate CVE-2025-5891
Immediate Actions Required
- Inventory all systems running Unitech pm2 and identify versions at or below 6.0.6
- Restrict network exposure of any interface that feeds untrusted input into pm2 configuration parsing
- Apply input length limits at upstream proxies or WAFs to blunt ReDoS payloads until patching is complete
Patch Information
A fix is available upstream via Unitech pm2 pull request #5971. Upgrade to a pm2 release incorporating this patch. Validate the fix in a staging environment before rolling out to production supervisors managing critical Node.js workloads.
Workarounds
- Constrain the length and character set of configuration-related input at the application boundary
- Run pm2 behind a reverse proxy that enforces request size and rate limits
- Isolate pm2 supervisors managing distinct workloads so a stalled daemon cannot cascade across unrelated services
- Increase monitoring granularity on pm2 daemons to detect and restart hung processes automatically
# Configuration example
npm install pm2@latest -g
pm2 update
pm2 --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
