CVE-2017-16137: Regular Expression Denial of Service in debug
Summary
CVE-2017-16137: Regular Expression Denial of Service in debug. Affects debug across 4 version ranges.
< 2.6.9
>= 3.0.0, < 3.1.0
>= 3.2.0, < 3.2.7
>= 4.0.0, < 4.3.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- node-debug · Debian:11
The same CVE-2017-16137 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The debug package is an npm package that provides a simple debugging utility for Node.js applications. It allows developers to easily add debug logging to their code, enabling them to track and troubleshoot issues during development and testing. However, certain versions of the debug package are vulnerable to regular expression denial of service (ReDoS) attacks when untrusted user input is passed into the o formatter. This vulnerability can lead to a denial of service (DoS) condition, where the event loop is blocked for a significant amount of time, impacting the performance and availability of the application.
Vulnerability Detail
The vulnerability in the debug package arises from the use of regular expressions in the o formatter. When untrusted user input is provided to this formatter, it can trigger a ReDoS attack. An attacker can craft malicious input that causes the regular expression to take an excessive amount of time to execute, leading to a DoS condition. The severity of this vulnerability is considered low, as it requires a large amount of input (around 50,000 characters) to block the event loop for only 2 seconds.
How To Fix
Latest published version: 4.4.3 as of 22 Oct 2026
npm install debug@4.4.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9npm install debug@2.6.9 -
>= 3.0.0, < 3.1.03.1.0npm install debug@3.1.0 -
>= 3.2.0, < 3.2.73.2.7npm install debug@3.2.7 -
>= 4.0.0, < 4.3.14.3.1npm install debug@4.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to sanitize and validate user input before passing it to the debug package or any other vulnerable code.
Conclusion
The debug package is vulnerable to regular expression denial of service (ReDoS) attacks when untrusted user input is passed into the o formatter. This can lead to a denial of service (DoS) condition, impacting the performance and availability of the application. It is recommended to update to the latest secure version of the debug package to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for debug →
FAQ
The debug package is an npm package that provides a simple debugging utility for Node.js applications. It allows developers to easily add debug logging to their code, enabling them to track and troubleshoot issues during development and testing.
Regular expression denial of service (ReDoS) is a type of vulnerability that occurs when a regular expression takes an excessive amount of time to match certain inputs. This can be exploited by an attacker to cause a denial of service (DoS) condition, where the targeted system becomes unresponsive or significantly slows down.
The impact of this vulnerability is a potential denial of service (DoS) condition in applications that use the vulnerable versions of the debug package. An attacker can craft malicious input that triggers a ReDoS attack, causing the event loop to be blocked for a significant amount of time. This can result in degraded performance and availability of the application.
The severity of this vulnerability is considered low. It requires a large amount of input (around 50,000 characters) to block the event loop for only 2 seconds. However, it is still important to update to the latest secure version to mitigate the risk of a potential DoS attack.
To fix this vulnerability, you can update the debug package to the latest secure version. For version 2.x.x, update to version 2.6.9 or later. For version 3.x.x, update to version 3.1.0 or later. Updating to these versions will include the necessary patches to mitigate the ReDoS vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for debug.
