Regular Expression Denial of Service in debug

Description

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.

Recommendation

Update the debug package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0, < 4.3.1

  >= 3.2.0, < 3.2.7

  >= 3.0.0, < 3.1.0

  < 2.6.9**

• Patched version(s): **4.3.1

  3.2.7

  3.1.0

  2.6.9**

References

• GHSA-gxpj-cx7g-858c
• lists.apache.org
• CVE-2017-16137
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in tough-cookie - CVE-2017-15010
• Regular Expression Denial of Service in slug - CVE-2017-16117
• Regular Expression Denial Of Service in uri-js - CVE-2017-16021
• Regular Expression Denial of Service in moment - CVE-2017-18214

Tags:

npm

debug