CVE-2017-16129: Large gzip Denial of Service in superagent
Summary
CVE-2017-16129: superagent vulnerable to zip bomb attacks. Affects superagent versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Also tracked for
- node-superagent · Debian:11
The same CVE-2017-16129 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Superagent is an npm package that provides a high-level HTTP request library for Node.js. It allows developers to make HTTP requests and handle responses easily. However, versions of superagent prior to 3.7.0 are vulnerable to a Denial of Service (DoS) attack due to a lack of post-decompression size checking of ZIP compressed HTTP responses. This vulnerability can be exploited by a ZIP bomb attack, where a small ZIP file can consume excessive CPU, memory, and disk resources when decompressed.
Vulnerability Detail
The vulnerability in superagent arises from the failure to validate the post-decompression size of ZIP compressed HTTP responses. This allows an attacker to send a malicious ZIP file that, when decompressed, expands to a significantly larger size than the original file. As a result, the system may experience unrestrained consumption of CPU, memory, and disk resources, leading to a DoS condition. This vulnerability has a low severity rating and is identified by the Common Weakness Enumeration (CWE) IDs: CWE-400 and CWE-409.
How To Fix
Latest published version: 10.4.1 as of 23 Oct 2026
npm install superagent@10.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.0
This is the first release that contains the fix.
npm install superagent@3.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to update superagent to the latest version.
Conclusion
The vulnerability in superagent allows for a DoS attack through a ZIP bomb, resulting in excessive resource consumption. It is crucial to update superagent to version 3.7.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for superagent →
FAQ
Superagent is an npm package that provides a high-level HTTP request library for Node.js. It simplifies the process of making HTTP requests and handling responses.
A ZIP bomb attack is a type of DoS attack where a small ZIP file, when decompressed, expands to an extremely large size, consuming excessive system resources.
The vulnerability in superagent can lead to a DoS condition, causing unrestrained consumption of CPU, memory, and disk resources. This can result in system slowdowns or crashes.
This vulnerability has a low severity rating.
To fix this vulnerability, update superagent to version 3.7.0 or later.
