Which versions of pm2 are affected by CVE-2025-5891?

Organizations using Unitech pm2 should be aware of moderate risk from CVE-2025-5891, a resource exhaustion vulnerability rated CVSS 4.3. Service availability could be impacted.. A patch is available.

Is there a public PoC exploit available for CVE-2025-5891?

Yes, a public proof-of-concept exploit is available for CVE-2025-5891. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5891?

Within 30 days: Identify affected systems running Unitech pm2 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

pm2 CVE-2025-5891

Q: What is the CVSS score of CVE-2025-5891?

CVE-2025-5891 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17577 LOW

Uncontrolled Resource Consumption (CWE-400)

2025-06-09 cna@vuldb.com

GHSA-x5gf-qvw8-r2rm

Denial Of Service Pm2

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Remote, low complexity, no privileges, no user interaction, only availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 13:30 vuln.today

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17577

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

PoC Detected

Jul 10, 2025 - 16:24 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 19:15 nvd

MEDIUM 4.3

CVE Published

Jun 09, 2025 - 19:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Inefficient regular expression complexity in Unitech pm2 up to 6.0.6 allows remote attackers to cause a denial of service via crafted input to the Config.js file. A publicly available exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.12%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability resides in the Config.js file of pm2, a popular Node.js process manager. The issue is a Regular Expression Denial of Service (ReDoS) attack, classified under CWE-400 (Uncontrolled Resource Consumption). The affected code uses a regex to split configuration values, which can be forced into catastrophic backtracking with a specially crafted long string, leading to excessive CPU consumption. The CPE string cpe:2.3:a:keymetric:pm2:*:*:*:*:*:*:*:* indicates the product is pm2 by Keymetric, though pm2 is commonly associated with Unitech. The vulnerability affects versions 6.0.0 through 6.0.6.

RemediationAI

Upgrade to pm2 version 6.0.7 or later, which includes the fix from pull request #5971. The patch modifies the regex in Config.js to prevent catastrophic backtracking. No workarounds are documented; however, restricting access to the configuration endpoint or input validation could mitigate the risk. The advisory is available at https://github.com/Unitech/pm2/pull/5971.