Inefficient Regular Expression Complexity in node-debug Package - CVE-2017-20165
Summary
CVE-2017-20165: A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. Affects node-debug across 4 version ranges.
< 3.1.0-1
< 13abeae468fea297d0dccc50bc55590809241083
< c38a0166c266a679c8de012d4eaccec3f944e685
< f073e056f33efdd5b311381eb6bca2bc850745bf
Fixed in 3.1.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-debug package is a popular debugging utility for Node.js applications, allowing developers to output debug information to the console. It provides features such as color-coded output and namespace-based filtering, making it easier to trace issues in code. However, versions up to 3.0.x have been found to be vulnerable to a specific issue that can lead to performance degradation due to inefficient regular expression handling.
Vulnerability Detail
CVE-2017-20165 is a vulnerability identified in the node-debug package, specifically in the useColors function within the src/node.js file. The vulnerability arises from the manipulation of the argument str, which can lead to inefficient regular expression complexity. This can potentially allow an attacker to exploit the application by causing excessive resource consumption, leading to denial of service. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
3.1.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-debugTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the fixed version as outlined above.
Conclusion
CVE-2017-20165 is a significant vulnerability in the node-debug package that can lead to performance issues in applications. Upgrading to version 3.1.0 or later is crucial to ensure the security and efficiency of your application. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for node-debug →
FAQ
CVE-2017-20165 is a vulnerability found in the node-debug package that can lead to inefficient regular expression complexity, potentially causing denial of service.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your package-lock.json file to check for vulnerabilities.
The recommended action is to upgrade the node-debug package to version 3.1.0 or later to mitigate the vulnerability.
The vulnerability can lead to excessive resource consumption, which may result in application slowdowns or crashes, effectively causing a denial of service.
Yes, Vulert allows you to monitor vulnerabilities using just a manifest file like package-lock.json, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for node-debug.
