debug Inefficient Regular Expression Complexity vulnerability

Description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue.

Recommendation

Update the debug package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.1.0

  < 2.6.9**

• Patched version(s): **3.1.0

  2.6.9**

References

• GHSA-9vvw-cc9w-f27h
• vuldb.com
• CVE-2017-20165
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Vercel ms Inefficient Regular Expression Complexity vulnerability - CVE-2017-20162
• axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749
• steal Inefficient Regular Expression Complexity vulnerability via string variable - CVE-2022-37259
• string-kit Inefficient Regular Expression Complexity vulnerability - CVE-2021-4299

Tags:

npm

debug