CVE-2017-20162
vercel ms index.js parse redos
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
vercel ms index.js parse redos
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
CVE-2017-20162- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 3.5
AV:N/AC:M/Au:S/C:N/I:N/A:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2023-0571
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
EUVD-2023-0571- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w9mr-4mfr-499f
Vercel ms Inefficient Regular Expression Complexity vulnerability
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
GHSA-w9mr-4mfr-499f- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
CVE-2017-20162- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:N/A:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVAZL-43849
CVE-2017-20162 affecting package nodejs-nodemon 2.0.3-4
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
AZL-43849- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-44002
CVE-2017-20162 affecting package js-jquery 3.5.0-4
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
AZL-44002- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 13 moreShow less
OSVAZL-45126
CVE-2017-20162 affecting package js-jquery 3.5.0-4
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
AZL-45126- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-45201
CVE-2017-20162 affecting package nodejs-nodemon 2.0.3-5
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
AZL-45201- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
CVE-2017-20162- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-w9mr-4mfr-499f
Vercel ms Inefficient Regular Expression Complexity vulnerability
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
GHSA-w9mr-4mfr-499f- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-20162
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
- Record
UBUNTU-CVE-2017-20162- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1773360972 No score
TuxCare security update for ms (1 CVE)
TuxCare rebuilt ms to address 1 CVE. Fixed in 0.7.1-tuxcare.1.
- Record
CLSA-2026-1773360972- Updated
- 2026-11-02
OSVCLSA-2026-1773360975 No score
TuxCare security update for ms (2 CVEs)
TuxCare rebuilt ms to address 2 CVEs. Fixed in 0.3.0-tuxcare.1.
- Record
CLSA-2026-1773360975- Updated
- 2026-11-02
OSVCLSA-2026-1776991063 No score
TuxCare security update for ms (1 CVE)
TuxCare rebuilt ms to address 1 CVE. Fixed in 2.0.0-tuxcare.1.
- Record
CLSA-2026-1776991063- Updated
- 2026-11-02
OSVCLSA-2026-1776991064 No score
TuxCare security update for ms (1 CVE)
TuxCare rebuilt ms to address 1 CVE. Fixed in 2.1.3-tuxcare.1.
- Record
CLSA-2026-1776991064- Updated
- 2026-11-02
OSVCLSA-2026-1776991065 No score
TuxCare security update for ms (1 CVE)
TuxCare rebuilt ms to address 1 CVE. Fixed in 0.7.2-tuxcare.2.
- Record
CLSA-2026-1776991065- Updated
- 2026-11-02
OSVCLSA-2026-1784596309 No score
TuxCare security update for ms (1 CVE)
TuxCare rebuilt ms to address 1 CVE. Fixed in 1.0.0-tuxcare.1.
- Record
CLSA-2026-1784596309- Updated
- 2026-11-02
OSVCLSA-2026-1784682956 No score
TuxCare security update for ms (2 CVEs)
TuxCare rebuilt ms to address 2 CVEs. Fixed in 0.6.2-tuxcare.1.
- Record
CLSA-2026-1784682956- Updated
- 2026-11-02
OSVCLSA-2026-1793303909 No score
TuxCare security update for ms (1 CVE)
TuxCare rebuilt ms to address 1 CVE. Fixed in 0.7.3-tuxcare.1.
- Record
CLSA-2026-1793303909- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
msnpm |
before 2.0.0 | 2.0.0 |
nodejs-nodemonAzure Linux:2 |
through 2.0.3-4 | None known |
js-jqueryAzure Linux:2 |
through 3.5.0-4 | None known |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
msTuxCare:npm |
0.7.1-tuxcare.0 up to 0.7.1-tuxcare.1, plus listed versions 0.7.1 |
0.7.1-tuxcare.1 |
msTuxCare:npm |
0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions 0.3.0 |
0.3.0-tuxcare.1 |
msTuxCare:npm |
2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions 2.0.0 |
2.0.0-tuxcare.1 |
msTuxCare:npm |
2.1.3-tuxcare.0 up to 2.1.3-tuxcare.1, plus listed versions 2.1.3 |
2.1.3-tuxcare.1 |
msTuxCare:npm |
0.7.2-tuxcare.0 up to 0.7.2-tuxcare.2, plus listed versions 0.7.20.7.2-tuxcare.1 |
0.7.2-tuxcare.2 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
msTuxCare:npm |
1.0.0-tuxcare.0 up to 1.0.0-tuxcare.1, plus listed versions 1.0.0 |
1.0.0-tuxcare.1 |
msTuxCare:npm |
0.6.2-tuxcare.0 up to 0.6.2-tuxcare.1, plus listed versions 0.6.2 |
0.6.2-tuxcare.1 |
msTuxCare:npm |
0.7.3-tuxcare.0 up to 0.7.3-tuxcare.1, plus listed versions 0.7.3 |
0.7.3-tuxcare.1 |
npmUbuntu:14.04:LTS |
All versions, plus listed versions 1.2.18~dfsg-31.3.10~dfsg-1 |
None known |
npmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.4.21+ds-23.5.2-0ubuntu43.5.2-0ubuntu4.1.16.04.1~esm1 |
None known |
npmUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.5.2-0ubuntu43.5.2-0ubuntu4.1.18.04.1~esm1 |
None known |
npmUbuntu:20.04:LTS |
All versions, plus listed versions 5.8.0+ds6-46.14.4+ds-1ubuntu2 |
None known |
npmUbuntu:22.04:LTS |
All versions, plus listed versions 7.5.2+ds-27.24.2+ds-17.24.2+ds-28.3.0~ds-18.3.0~ds-28.3.2~ds-18.5.0~ds-18.5.1~ds-1 |
None known |
qt6-webengineUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-1ubuntu26.2.4+dfsg-6ubuntu1 |
None known |
npmUbuntu:24.04:LTS |
All versions, plus listed versions 9.2.0~ds1-19.2.0~ds1-2 |
None known |
qt6-webengineUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2-final+dfsg-116.4.2-final+dfsg-126.4.2-final+dfsg-12build16.4.2-final+dfsg-12ubuntu16.4.2-final+dfsg-12ubuntu76.4.2-final+dfsg-12ubuntu9 |
None known |
npmUbuntu:25.10 |
All versions, plus listed versions 9.2.0~ds1-3 |
None known |
qt6-webengineUbuntu:25.10 |
All versions, plus listed versions 6.8.3+dfsg-0ubuntu16.8.3+dfsg-0ubuntu26.9.2+dfsg-2 |
None known |
npmUbuntu:26.10 |
All versions, plus listed versions 9.2.0~ds3-111.16.0+ds2-4 |
None known |
qt6-webengineUbuntu:26.10 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-46.10.2+dfsg-56.11.2+dfsg-3ubuntu16.11.2+dfsg-3ubuntu2 |
None known |
npmUbuntu:26.04:LTS |
All versions, plus listed versions 9.2.0~ds1-39.2.0~ds2-29.2.0~ds3-1 |
None known |
qt6-webengineUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2+dfsg-26.9.2+dfsg-46.9.2+dfsg-4build16.9.2+dfsg-4build26.10.2+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-20162 is a medium vulnerability (CVSS 4.3) in Vercel Ms, published January 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in ms 2.0.0.