CVE-2017-16098: Regular Expression Denial of Service in charset
Summary
CVE-2017-16098: Regular Expression Denial of Service in charset. Affects charset versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The charset package is an npm package that provides character encoding and decoding functionality. It is commonly used in Node.js applications to handle character set conversions. This package is vulnerable to a regular expression denial of service (ReDoS) attack. The vulnerability allows an attacker to craft a malicious input that can cause the package's regular expression engine to enter an infinite loop, resulting in a denial of service condition. The impact of this vulnerability can be significant if Node.js was compiled using the -DHTTP_MAX_HEADER_SIZE flag, as it can exploit the default max HTTP header length in Node.js.
Vulnerability Detail
The vulnerability in the charset package arises from a regular expression that can be exploited by an attacker to cause a denial of service. By providing a specially crafted input that triggers the vulnerable regular expression, an attacker can cause the package's regular expression engine to consume excessive CPU resources, leading to a significant slowdown or unresponsiveness of the affected application. The amplification factor of this vulnerability is relatively low, taking around 2 seconds for the engine to execute on a malicious input that is 50,000 characters in length. However, if Node.js was compiled with the -DHTTP_MAX_HEADER_SIZE flag, the impact can be more severe due to the default max HTTP header length in Node.js.
How To Fix
Latest published version: 1.0.1 as of 23 Oct 2026
npm install charset@1.0.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the charset package to the latest version.
Conclusion
The charset package is vulnerable to a regular expression denial of service (ReDoS) attack. It is recommended to update the package to version 1.0.1 or later to mitigate this vulnerability. Vulert's playground at https://vulert.com/scanner can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for charset →
FAQ
The impact of this vulnerability can be significant if Node.js was compiled using the -DHTTP_MAX_HEADER_SIZE flag, as it can exploit the default max HTTP header length in Node.js. It can lead to a denial of service condition, causing the affected application to slow down or become unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
The recommended mitigation is to update the charset package to version 1.0.1 or later. This will patch the vulnerable regular expression and protect against ReDoS attacks.
If your Node.js application was compiled with the -DHTTP_MAX_HEADER_SIZE flag, you can consider adjusting the max HTTP header length to a lower value to reduce the impact of this vulnerability. However, the recommended approach is to update the charset package to the latest version.
