CVE-2017-16119: High severity fresh project vulnerability
Affected versions of fresh are vulnerable to regular expression denial of service when parsing specially crafted user input.
Recommendation
Update to version 0.5.2 or later.
Other sources
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Node.js fresh module is vulnerable to regular expression denial of service when passing untrusted user input. A remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-16119?
CVE-2017-16119 is a vulnerability in the Fresh module used by the Express.js framework for HTTP response freshness testing.
What is the severity of CVE-2017-16119?
The severity of CVE-2017-16119 is high with a CVSS score of 7.5.
How does CVE-2017-16119 affect software?
CVE-2017-16119 affects versions of Fresh up to and excluding 0.5.2.
What is the impact of CVE-2017-16119?
CVE-2017-16119 can cause a denial of service condition by blocking the event loop.
How can I fix CVE-2017-16119?
To fix CVE-2017-16119, update Fresh to version 0.5.2 or higher.