CVE-2017-16137: Medium severity Debug Project Debug Node.js vulnerability
Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.
As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.
This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.
Recommendation
Version 2.x.x: Update to version 2.6.9 or later. Version 3.1.x: Update to version 3.1.0 or later. Version 3.2.x: Update to version 3.2.7 or later. Version 4.x.x: Update to version 4.3.1 or later.
Other sources
Node.js debug module is vulnerable to regular expression denial of service when passing untrusted user input. A remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16137?
The severity of CVE-2017-16137 is medium with a severity value of 5.3.
Which versions of debug are affected by CVE-2017-16137?
Versions 2.0.0 to 2.6.9, 3.0.0 to 3.1.0, and 4.0.0 to 4.3.1 of debug are affected by CVE-2017-16137.
What is the vulnerability of CVE-2017-16137?
CVE-2017-16137 is a regular expression denial of service vulnerability in the debug module of Node.js.
How can I fix CVE-2017-16137?
To fix CVE-2017-16137, update the debug module to version 2.6.9, 3.1.0, or 4.3.1, depending on the version you are using.
Where can I find more information about CVE-2017-16137?
You can find more information about CVE-2017-16137 on the NVD NIST page (https://nvd.nist.gov/vuln/detail/CVE-2017-16137) and on the GitHub issues (https://github.com/visionmedia/debug/issues/501) and pull request (https://github.com/visionmedia/debug/pull/504) for debug.