p PatchFirst

CVE-2017-16137

CVE-2017-16137

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

CVSS 5.3 · Medium · EPSS 2.8% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • debug node module

    Versions
    • <= 2.6.8 || >= 3.0.0 <= 3.0.1: Affected

    No fix published

  • node-debug Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.1.0-1

    Update to 3.1.0-1

  • node-debug Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.0-1

    Update to 3.1.0-1

  • node-debug Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.0-1

    Update to 3.1.0-1

  • debug npm

    Affected ranges
    • SEMVER: < 2.6.9

    Update to 2.6.9

  • debug npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.1.0

    Update to 3.1.0

  • debug npm

    Affected ranges
    • SEMVER: ≥ 3.2.0, < 3.2.7

    Update to 3.2.7

  • debug npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 4.3.1

    Update to 4.3.1

  • node-debug Ubuntu:16.04:LTS

    Versions
    • 2.1.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →