{"id":"EUVD-2018-0256","enisaUuid":"0b16f2eb-bf27-3b2e-8d4f-9201b93500c6","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","datePublished":"Jun 7, 2018, 2:00:00 AM","dateUpdated":"Oct 8, 2026, 7:43:05 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://nodesecurity.io/advisories/526\n","aliases":"CVE-2017-16119\nGHSA-9qj9-36jm-prpv\n","assigner":"hackerone","epss":1.56,"enisaIdProduct":[{"id":"1dcff55b-4c0e-3450-9313-968f2ab28d3d","product":{"name":"fresh node module","vendor":{"name":"HackerOne"}},"product_version":"\u003c 0.5.2"}],"enisaIdVendor":[{"id":"804c62d4-5f40-3e0d-ae52-387cc9df199d","vendor":{"name":"HackerOne"}}],"enisaIdVulnerability":[{"id":"55f91357-ad10-3ea9-b565-ebd1713ac61f","vulnerability":{"id":"CVE-2017-16119","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","datePublished":"Jun 7, 2018, 2:00:00 AM","dateUpdated":"Oct 8, 2026, 7:43:05 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://nodesecurity.io/advisories/526\n","enisa_id":"EUVD-2018-0256\n","assigner":"hackerone","epss":1.56,"dataProcessed":"Oct 24, 2026, 7:15:12 AM","vulnerabilityProduct":[{"id":"3bd60c28-c715-3dbe-9537-25668c177f07","product":{"name":"fresh node module","vendor":{"name":"HackerOne"}},"product_version":"\u003c 0.5.2"}],"vulnerabilityVendor":[{"id":"188c11ac-2413-3031-8f19-5e4e5013642a","vendor":{"name":"HackerOne"}}]}},{"id":"6d5d79bf-8026-3f95-9014-24a5493c890f","vulnerability":{"id":"GHSA-9qj9-36jm-prpv","description":"Regular Expression Denial of Service in fresh","datePublished":"Jul 24, 2018, 8:16:57 PM","dateUpdated":"Sep 8, 2023, 9:32:03 PM","baseScore":null,"references":"https://nvd.nist.gov/vuln/detail/CVE-2017-16119\nhttps://github.com/advisories/GHSA-9qj9-36jm-prpv\nhttps://www.npmjs.com/advisories/526\n","enisa_id":"EUVD-2018-0256\n","aliases":"GHSA-9qj9-36jm-prpv\nCVE-2017-16119\n","epss":0.0,"dataProcessed":"May 3, 2026, 1:44:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}