CVE-2017-20165: Inefficient Regular Expression Complexity in debug-js debug
Summary
CVE-2017-20165: debug Inefficient Regular Expression Complexity vulnerability. Affects debug across 2 version ranges.
< 2.6.9
>= 3.0.0, < 3.1.0
Fixed in 2.6.9 or 3.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- node-debug · Debian:11
The same CVE-2017-20165 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The debug package is an npm package used for debugging purposes in Node.js applications. It provides a simple debugging utility that can be used to log debug information during runtime. The package is widely used in the Node.js ecosystem and is known for its ease of use and flexibility. However, versions up to 3.0.x of the debug package are vulnerable to an inefficient regular expression complexity issue in the useColors function of the src/node.js file. This vulnerability can be exploited by manipulating the str argument, leading to inefficient regular expression complexity.
Vulnerability Detail
The inefficient regular expression complexity vulnerability in the debug package can have significant performance implications. An attacker can exploit this vulnerability by providing a specially crafted input to the useColors function, causing the regular expression to exhibit exponential time complexity. This can result in excessive CPU usage and potentially lead to denial of service (DoS) attacks. The vulnerability has been assigned the identifier VDB-217665 and has a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How To Fix
Latest published version: 4.4.3 as of 22 Oct 2026
npm install debug@4.4.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9npm install debug@2.6.9 -
>= 3.0.0, < 3.1.03.1.0npm install debug@3.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the patched version of the debug package.
Conclusion
The debug package up to version 3.0.x is vulnerable to an inefficient regular expression complexity issue. This vulnerability can be exploited to cause excessive CPU usage and potential denial of service (DoS) attacks. To mitigate the risk, it is recommended to upgrade to version 3.1.0 or later. Alternatively, if you are using an older version, you can upgrade to version 2.6.9. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for debug →
FAQ
The debug package is an npm package used for debugging purposes in Node.js applications. It provides a simple debugging utility that can be used to log debug information during runtime.
The vulnerability can result in inefficient regular expression complexity, leading to excessive CPU usage and potential denial of service (DoS) attacks.
To fix this vulnerability, you should upgrade the debug package to version 3.1.0 or later. Alternatively, if you are using an older version (0.x to 2.6.x), you can upgrade to version 2.6.9.
There is no specific workaround mentioned for this vulnerability. It is recommended to upgrade to the patched version of the debug package.
You can find more information about this vulnerability in the GitHub Advisory Database. The vulnerability has been assigned the identifier VDB-217665.
References
Related vulnerabilities
Recent vulnerabilities recorded for debug.
