Regular Expression Denial of Service in Node-Debug Package
Summary
DEBIAN-CVE-2017-16137: The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. Affects node-debug versions < 3.1.0-1. Fixed in 3.1.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Debug is a popular debugging utility for Node.js applications, allowing developers to output debug information to the console. It is widely used due to its simplicity and effectiveness in tracking down issues during development. However, it has been identified to have a vulnerability that can be exploited when untrusted user input is processed, leading to potential denial of service attacks.
Vulnerability Detail
The vulnerability arises from the way the debug module handles untrusted user input passed into the 'o' formatter. When a large amount of data (around 50,000 characters) is processed, it can cause the application to block for approximately 2 seconds, resulting in a denial of service. This issue is classified as low severity but can still impact the performance and availability of applications relying on this package.
How To Fix
Minimum fixed version
3.1.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-debugTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user input before passing it to the debug module to prevent excessive data from being processed. This can be done by limiting the length of input or filtering out potentially harmful characters.
Conclusion
The Node-Debug package has a vulnerability that can lead to denial of service when processing untrusted input. It is crucial to update to the patched version to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for node-debug →
FAQ
The vulnerability is a regular expression denial of service (ReDoS) that occurs when untrusted input is processed, causing the application to block for an extended period.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your manifest file.
While classified as low severity, it can still affect application performance and availability, making it important to address.
If an immediate update is not possible, implement input sanitization as a temporary workaround to mitigate the risk of exploitation.
Detailed information can be found in the CVE report for DEBIAN-CVE-2017-16137, which outlines the specifics of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-debug.
