Every CVE Search/ Get API key

CVE-2017-16137

Regular Expression Denial of Service in debug

5.3 MediumFix available

CVE-2017-16137 is a medium vulnerability (CVSS 5.3) in Debug Project Debug, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in debug 2.6.9.

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

2.83%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
CVE-2017-16137
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
CVE-2017-16137
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2018-0400 No score

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
EUVD-2018-0400
Updated
2026-11-02
GitHub AdvisoriesGHSA-gxpj-cx7g-858c 3.7

Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.

Recommendation

Version 2.x.x: Update to version 2.6.9 or later. Version 3.1.x: Update to version 3.1.0 or later. Version 3.2.x: Update to version 3.2.7 or later. Version 4.x.x: Update to version 4.3.1 or later.

Record
GHSA-gxpj-cx7g-858c
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
OSVAZL-43792 5.3

CVE-2017-16137 affecting package js-jquery 3.5.0-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
AZL-43792
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-43819 5.3

CVE-2017-16137 affecting package nodejs-nodemon 2.0.3-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
AZL-43819
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 22 moreShow less
OSVAZL-44400 5.3

CVE-2017-16137 affecting package js-jquery 3.5.0-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
AZL-44400
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-44772 5.3

CVE-2017-16137 affecting package nodejs-nodemon 2.0.3-5

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
AZL-44772
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 5.3

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
CVE-2017-16137
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2017-16137 5.3

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
DEBIAN-CVE-2017-16137
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVGHSA-gxpj-cx7g-858c 3.7

Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.

Recommendation

Version 2.x.x: Update to version 2.6.9 or later. Version 3.1.x: Update to version 3.1.0 or later. Version 3.2.x: Update to version 3.2.7 or later. Version 4.x.x: Update to version 4.3.1 or later.

Record
GHSA-gxpj-cx7g-858c
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
OSVUBUNTU-CVE-2017-16137 5.3

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Record
UBUNTU-CVE-2017-16137
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVCLSA-2026-1772928825 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.3.3-tuxcare.1.

Record
CLSA-2026-1772928825
Updated
2026-11-02
OSVCLSA-2026-1773101693 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.1.1-tuxcare.2.

Record
CLSA-2026-1773101693
Updated
2026-11-02
OSVCLSA-2026-1774225201 No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 1.0.5-tuxcare.1.

Record
CLSA-2026-1774225201
Updated
2026-11-02
OSVCLSA-2026-1774225208 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 3.2.6-tuxcare.1.

Record
CLSA-2026-1774225208
Updated
2026-11-02
OSVCLSA-2026-1774225219 No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.2.0-tuxcare.1.

Record
CLSA-2026-1774225219
Updated
2026-11-02
OSVCLSA-2026-1776904642 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 4.4.3-tuxcare.1.

Record
CLSA-2026-1776904642
Updated
2026-11-02
OSVCLSA-2026-1776904643 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 3.2.7-tuxcare.1.

Record
CLSA-2026-1776904643
Updated
2026-11-02
OSVCLSA-2026-1776904644 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 3.1.0-tuxcare.1.

Record
CLSA-2026-1776904644
Updated
2026-11-02
OSVCLSA-2026-1776904645 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.6.9-tuxcare.1.

Record
CLSA-2026-1776904645
Updated
2026-11-02
OSVCLSA-2026-1784596290 No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.6.4-tuxcare.1.

Record
CLSA-2026-1784596290
Updated
2026-11-02
OSVCLSA-2026-1787560902 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.4-tuxcare.2.

Record
CLSA-2026-1787560902
Updated
2026-11-02
OSVCLSA-2026-1787561993 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.2-tuxcare.2.

Record
CLSA-2026-1787561993
Updated
2026-11-02
OSVCLSA-2026-1787562139 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.3-tuxcare.2.

Record
CLSA-2026-1787562139
Updated
2026-11-02
OSVCLSA-2026-1787562258 No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.1.0-tuxcare.2.

Record
CLSA-2026-1787562258
Updated
2026-11-02
OSVCLSA-2026-1792594199 No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.0.0-tuxcare.1.

Record
CLSA-2026-1792594199
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2017-16137 No score

CVE-2017-16137 in @rootio/debug - Patched by Root

Root has patched CVE-2017-16137 in the @rootio/debug package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2017-16137
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
debug
npm
 before 2.6.9
2.6.9
debug
npm
 3.0.0 up to 3.1.0
3.1.0
debug
npm
 3.2.0 up to 3.2.7
3.2.7
debug
npm
 4.0.0 up to 4.3.1
4.3.1
js-jquery
Azure Linux:2
 through 3.5.0-4 None known
nodejs-nodemon
Azure Linux:2
 through 2.0.3-4 None known
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
debug
TuxCare:npm
 2.3.3-tuxcare.0 up to 2.3.3-tuxcare.1, plus listed versions
2.3.3
2.3.3-tuxcare.1
debug
TuxCare:npm
 2.1.1-tuxcare.0 up to 2.1.1-tuxcare.2, plus listed versions
2.1.12.1.1-tuxcare.1
2.1.1-tuxcare.2
Show 19 moreShow less
Affected packages
PackageAffectedFixed
debug
TuxCare:npm
 1.0.5-tuxcare.0 up to 1.0.5-tuxcare.1, plus listed versions
1.0.5
1.0.5-tuxcare.1
debug
TuxCare:npm
 3.2.6-tuxcare.0 up to 3.2.6-tuxcare.1, plus listed versions
3.2.6
3.2.6-tuxcare.1
debug
TuxCare:npm
 2.2.0-tuxcare.0 up to 2.2.0-tuxcare.1, plus listed versions
2.2.0
2.2.0-tuxcare.1
debug
TuxCare:npm
 4.4.3-tuxcare.0 up to 4.4.3-tuxcare.1, plus listed versions
4.4.3
4.4.3-tuxcare.1
debug
TuxCare:npm
 3.2.7-tuxcare.0 up to 3.2.7-tuxcare.1, plus listed versions
3.2.7
3.2.7-tuxcare.1
debug
TuxCare:npm
 3.1.0-tuxcare.0 up to 3.1.0-tuxcare.1, plus listed versions
3.1.0
3.1.0-tuxcare.1
debug
TuxCare:npm
 2.6.9-tuxcare.0 up to 2.6.9-tuxcare.1, plus listed versions
2.6.9
2.6.9-tuxcare.1
debug
TuxCare:npm
 2.6.4-tuxcare.0 up to 2.6.4-tuxcare.1, plus listed versions
2.6.4
2.6.4-tuxcare.1
debug
TuxCare:npm
 1.0.4-tuxcare.0 up to 1.0.4-tuxcare.2, plus listed versions
1.0.41.0.4-tuxcare.1
1.0.4-tuxcare.2
debug
TuxCare:npm
 1.0.2-tuxcare.0 up to 1.0.2-tuxcare.2, plus listed versions
1.0.21.0.2-tuxcare.1
1.0.2-tuxcare.2
debug
TuxCare:npm
 1.0.3-tuxcare.0 up to 1.0.3-tuxcare.2, plus listed versions
1.0.31.0.3-tuxcare.1
1.0.3-tuxcare.2
debug
TuxCare:npm
 2.1.0-tuxcare.0 up to 2.1.0-tuxcare.2, plus listed versions
2.1.02.1.0-tuxcare.1
2.1.0-tuxcare.2
debug
TuxCare:npm
 2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions
2.0.0
2.0.0-tuxcare.1
node-debug
Debian:12
 before 3.1.0-1
3.1.0-1
node-debug
Debian:13
 before 3.1.0-1
3.1.0-1
node-debug
Debian:14
 before 3.1.0-1
3.1.0-1
@rootio/debug
Root:npm
 before 4.1.0-root.io.1
4.1.0-root.io.1
debug
Root:npm
 before 4.1.0-aikido.1
4.1.0-aikido.1
node-debug
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.1.0+dfsg-2
 None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open