CVE-2017-16117: Regular Expression Denial of Service in slug
Summary
CVE-2017-16117: Regular Expression Denial of Service in slug. Affects slug versions < 0.9.2. Fixed in 0.9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The slug package is an npm package that provides a simple way to generate URL-friendly slugs from strings. It is commonly used in web applications to create human-readable URLs. The package takes user input and converts it into a URL-friendly format by removing special characters and replacing spaces with hyphens. However, versions of slug prior to 0.9.2 are vulnerable to a regular expression denial of service (ReDoS) attack when parsing untrusted user input.
Vulnerability Detail
The vulnerability in slug is due to inefficient regular expressions used in the package. An attacker can exploit this vulnerability by providing a specially crafted input that triggers the ReDoS attack. This can cause the event loop to block for up to 2 seconds, resulting in a denial of service. Although the severity of the issue is low, as it requires a large input (approximately 50,000 characters) to cause the event loop to block, it is still important to update to version 0.9.2 or later to mitigate the risk.
How To Fix
Latest published version: 12.0.1 as of 23 Oct 2026
npm install slug@12.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.2
This is the first release that contains the fix.
npm install slug@0.9.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the slug package is vulnerable to a regular expression denial of service (ReDoS) attack. It is recommended to update to version 0.9.2 or later to mitigate the risk. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for slug →
FAQ
The impact of this vulnerability is a potential denial of service, where the event loop can be blocked for up to 2 seconds. This can disrupt the normal functioning of the application and cause delays in processing user requests.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of the slug package to mitigate the risk.
Yes, this vulnerability affects versions of slug prior to 0.9.2. It has been fixed in version 0.9.2 and later.
There is no evidence of this vulnerability being exploited in the wild. However, it is still important to update to the latest version of the slug package to ensure the security of your application.
