{"id":"CVE-2017-16137","revision":"c884e4c9efa14c239fc0070a0785dba4","records":[{"revision":"c884e4c9efa14c239fc0070a0785dba4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2017-16137","aliases":[],"title":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","description":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","state":0,"publishedAt":"2018-06-07T02:00:00+00:00","modifiedAt":"2026-10-15T15:54:18.885+00:00","affected":[{"ecosystem":"Vendor product","name":"debug node module","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"debug node module\",\n                    \"vendor\": \"HackerOne\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"<= 2.6.8 || >= 3.0.0 <= 3.0.1\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/visionmedia/debug/pull/504","https://github.com/visionmedia/debug/issues/501","https://nodesecurity.io/advisories/534","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2017-16137","license":"CVE Program Terms of Use","key":"cve-program:CVE-2017-16137","identifiers":["CVE-2017-16137"]},"retained":false,"historicalAffected":[]}],"coverage":[]}