debug Inefficient Regular Expression Complexity vulnerability

Description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue.

Recommendation

Update the debug package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.1.0

  < 2.6.9**

• Patched version(s): **3.1.0

  2.6.9**

References

• GHSA-9vvw-cc9w-f27h
• vuldb.com
• CVE-2017-20165
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• The AuthKit Remix Library renders sensitive auth data in HTML - CVE-2025-55009
• NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies - CVE-2025-48947
• Strapi allows Server-Side Request Forgery in Webhook function - CVE-2024-52588
• Redoc Prototype Pollution via `Module.mergeObjects` Component - CVE-2024-57083

Tags:

npm

debug