CVE-2017-20162: Vercel ms Inefficient Regular Expression Complexity Vulnerability
Summary
CVE-2017-20162: Vercel ms Inefficient Regular Expression Complexity vulnerability. Affects ms versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ms' package is an npm package used for converting various time formats to milliseconds. It is commonly used in JavaScript applications to handle time-related operations. The vulnerability in the 'ms' package up to version 1.x allows for inefficient regular expression complexity. This vulnerability can be exploited remotely and has been publicly disclosed. Upgrading to version 2.0.0 resolves this issue. The associated patch is named caae2988ba2a37765d055c4eee63d383320ee662.
Vulnerability Detail
The vulnerability in the 'ms' package arises from inefficient regular expression complexity in the 'parse' function of the 'index.js' file. By manipulating the 'str' argument, an attacker can trigger excessive computational overhead due to the inefficient regular expression. This vulnerability can be exploited remotely, potentially leading to denial of service (DoS) attacks. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.3.
How To Fix
Latest published version: 2.1.3 as of 22 Oct 2026
npm install ms@2.1.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
npm install ms@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The 'ms' package up to version 1.x is vulnerable to an inefficient regular expression complexity issue. This vulnerability can be exploited remotely and may result in denial of service attacks. It is recommended to upgrade to version 2.0.0 or higher to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ms →
FAQ
The 'ms' package is an npm package used for converting various time formats to milliseconds. It is commonly used in JavaScript applications to handle time-related operations.
This vulnerability allows for inefficient regular expression complexity, which can be exploited remotely. It may lead to denial of service (DoS) attacks.
To fix this vulnerability, upgrade the 'ms' package to version 2.0.0 or higher by updating the package version in the project's package.json file and running the package manager's update command.
No specific workaround is provided for this vulnerability. Upgrading to the fixed version is the recommended solution.
The CVSS score for this vulnerability is 5.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for ms.
