GitHub Advisoryadvisory · npm

GHSA-gxpj-cx7g-858c Regular Expression Denial of Service in debug

LOW Published 2018-08-09 Modified 2024-03-25 Official page ↗
Aliases
CVE-2017-16137
Ecosystem
npm
Packages
debug
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm debug: < 2.6.9 → fixed in 2.6.9 • npm debug: >= 3.0.0, < 3.1.0 → fixed in 3.1.0 • npm debug: >= 3.2.0, < 3.2.7 → fixed in 3.2.7 • npm debug: >= 4.0.0, < 4.3.1 → fixed in 4.3.1

Description

Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue. This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1. Recommendation Version 2.x.x: Update to version 2.6.9 or later. Version 3.1.x: Update to version 3.1.0 or later. Version 3.2.x: Update to version 3.2.7 or later. Version 4.x.x: Update to version 4.3.1 or later.

Related

Alias · CVE (1)

  • CVE-2017-16137 The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References