{"id":"EUVD-2018-0400","enisaUuid":"08670f51-46b5-3fab-841a-f8bfdc8d938e","description":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","datePublished":"Jun 7, 2018, 2:00:00 AM","dateUpdated":"Oct 15, 2026, 3:54:18 PM","baseScore":null,"references":"https://github.com/visionmedia/debug/pull/504\nhttps://github.com/visionmedia/debug/issues/501\nhttps://nodesecurity.io/advisories/534\nhttps://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E\nhttps://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E\n","aliases":"CVE-2017-16137\nGHSA-gxpj-cx7g-858c\n","assigner":"hackerone","epss":2.83,"enisaIdProduct":[{"id":"0080e167-acf3-34ec-8b63-d2c3272f3f30","product":{"name":"debug node module","vendor":{"name":"HackerOne"}},"product_version":"≤ 2.6.8     3.0.0 ≤ 3.0.1"}],"enisaIdVendor":[{"id":"db87859d-5297-34c6-9b0b-27f3bbaf268c","vendor":{"name":"HackerOne"}}],"enisaIdVulnerability":[{"id":"0cde115e-e2cc-39ce-b1aa-a9d0048ddd22","vulnerability":{"id":"CVE-2017-16137","description":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","datePublished":"Jun 7, 2018, 2:00:00 AM","dateUpdated":"Oct 15, 2026, 3:54:18 PM","status":"PUBLISHED","baseScore":null,"references":"https://github.com/visionmedia/debug/pull/504\nhttps://github.com/visionmedia/debug/issues/501\nhttps://nodesecurity.io/advisories/534\nhttps://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E\nhttps://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E\n","enisa_id":"EUVD-2018-0400\n","assigner":"hackerone","epss":2.83,"dataProcessed":"Nov 3, 2026, 7:15:36 AM","vulnerabilityProduct":[{"id":"0d17f64e-3aea-35e9-b1e3-0e8feea44d03","product":{"name":"debug node module","vendor":{"name":"HackerOne"}},"product_version":"≤ 2.6.8     3.0.0 ≤ 3.0.1"}],"vulnerabilityVendor":[{"id":"17ecce65-2808-39fa-9102-cc64b3cbb959","vendor":{"name":"HackerOne"}}]}},{"id":"6fc80d69-b0a8-3464-9650-e9fe55c5211d","vulnerability":{"id":"GHSA-gxpj-cx7g-858c","description":"Regular Expression Denial of Service in debug","datePublished":"Aug 9, 2018, 8:18:07 PM","dateUpdated":"Mar 25, 2024, 7:01:23 PM","baseScore":null,"references":"https://nvd.nist.gov/vuln/detail/CVE-2017-16137\nhttps://github.com/debug-js/debug/issues/797\nhttps://github.com/visionmedia/debug/issues/501\nhttps://github.com/visionmedia/debug/pull/504\nhttps://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020\nhttps://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290\nhttps://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac\nhttps://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a\nhttps://github.com/visionmedia/debug\nhttps://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E\nhttps://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E\n","enisa_id":"EUVD-2018-0400\n","aliases":"CVE-2017-16137\nGHSA-gxpj-cx7g-858c\n","epss":0.0,"dataProcessed":"May 3, 2026, 1:44:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"72ec345d-b546-34b8-91eb-56c47417b901","advisory":{"id":"RHSA-2021:3917","description":"Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update","summary":"An update is now available for Red Hat Quay 3.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"Oct 19, 2021, 12:09:35 PM","dateUpdated":"Oct 29, 2026, 6:23:53 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2021:3917\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3917.json\n","aliases":"CVE-2017-16137\nCVE-2017-16138\nCVE-2018-1107\nCVE-2018-1109\nCVE-2018-3721\nCVE-2018-3728\nCVE-2018-3774\nCVE-2018-16492\nCVE-2018-21270\nCVE-2019-20920\nCVE-2019-20922\nCVE-2019-1010266\nCVE-2020-7608\nCVE-2020-8203\nCVE-2020-15366\nCVE-2020-26237\nCVE-2020-26291\nCVE-2020-35653\nCVE-2020-35654\nCVE-2021-23364\nCVE-2021-23368\nCVE-2021-23382\nCVE-2021-25289\nCVE-2021-25290\nCVE-2021-25291\nCVE-2021-25292\nCVE-2021-25293\nCVE-2021-27515\nCVE-2021-27516\nCVE-2021-27921\nCVE-2021-27922\nCVE-2021-27923\nCVE-2021-34552\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"05a94e0b-e0fb-351a-b63d-e4921b20adad","product":{"name":"quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64","vendor":{"name":"Red Hat"}}},{"id":"0f34d31a-0410-36bf-b296-27405b64279e","product":{"name":"quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64","vendor":{"name":"Red Hat"}}},{"id":"1a94a414-7886-3377-ae86-dbfeea60c366","product":{"name":"quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64","vendor":{"name":"Red Hat"}}},{"id":"2bf51dc3-dd8f-3535-afb5-4d5a8f20e23f","product":{"name":"quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64","vendor":{"name":"Red Hat"}}},{"id":"3f5ff6e6-ac90-3c7c-b404-8727cbb7da4e","product":{"name":"quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64","vendor":{"name":"Red Hat"}}},{"id":"4a867c2c-082f-3f53-9c5d-ef1043d4034f","product":{"name":"quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64","vendor":{"name":"Red Hat"}}},{"id":"60957270-43ee-3b5a-94d2-3b7b300e0adc","product":{"name":"quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64","vendor":{"name":"Red Hat"}}},{"id":"7ee65ed6-1af7-38b9-85dd-056f3fd92c3a","product":{"name":"quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64","vendor":{"name":"Red Hat"}}},{"id":"b3765dd8-db81-394f-bcce-aadceb427602","product":{"name":"quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64","vendor":{"name":"Red Hat"}}},{"id":"e6fb867a-c58b-337d-a390-52d7c24a0c49","product":{"name":"quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64","vendor":{"name":"Red Hat"}}},{"id":"f3ab269d-fc66-3a2e-9c10-3554429eb98c","product":{"name":"Quay v3","vendor":{"name":"Red Hat"}}}]}}]}