CVE-2017-16118
Arbitrary File Overwrite in decompress-zip
The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
CVE-2017-16118- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
CVE-2017-16118- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0298 No score
The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
EUVD-2018-0298- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mpcf-4gmh-23w8
Regular Expression Denial of Service in forwarded
Affected versions of forwarded are vulnerable to regular expression denial of service when parsing specially crafted user input.
Recommendation
Update to version 0.1.2 or later
- Record
GHSA-mpcf-4gmh-23w8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-73v8-v6g4-vrpm No score
Arbitrary File Overwrite in decompress-zip
Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory.
Recommendation
For decompress-zip 0.2.x upgrade to 0.2.2 or later.
For decompress-zip 0.3.x upgrade to 0.3.2 or later.
- Record
GHSA-73v8-v6g4-vrpm- Updated
- 2026-11-02
OSVAZL-44496
CVE-2017-16118 affecting package nodejs-nodemon 2.0.3-5
The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
AZL-44496- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-mpcf-4gmh-23w8
Regular Expression Denial of Service in forwarded
Affected versions of forwarded are vulnerable to regular expression denial of service when parsing specially crafted user input.
Recommendation
Update to version 0.1.2 or later
- Record
GHSA-mpcf-4gmh-23w8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1773706635 No score
TuxCare security update for forwarded (1 CVE)
TuxCare rebuilt forwarded to address 1 CVE. Fixed in 0.1.0-tuxcare.1.
- Record
CLSA-2026-1773706635- Updated
- 2026-11-02
OSVCLSA-2026-1774225215 No score
TuxCare security update for decompress-zip (1 CVE)
TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1.
- Record
CLSA-2026-1774225215- Updated
- 2026-11-02
OSVCLSA-2026-1774398084 No score
TuxCare security update for git-clone (5 CVEs)
TuxCare rebuilt git-clone to address 5 CVEs. Fixed in 0.1.0-tuxcare.1.
- Record
CLSA-2026-1774398084- Updated
- 2026-11-02
OSVGHSA-73v8-v6g4-vrpm No score
Arbitrary File Overwrite in decompress-zip
Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory.
Recommendation
For decompress-zip 0.2.x upgrade to 0.2.2 or later.
For decompress-zip 0.3.x upgrade to 0.3.2 or later.
- Record
GHSA-73v8-v6g4-vrpm- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
decompress-zipnpm |
before 0.2.2 | 0.2.2 |
decompress-zipnpm |
0.3.0 up to 0.3.2 | 0.3.2 |
forwardednpm |
before 0.1.2 | 0.1.2 |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
forwardedTuxCare:npm |
0.1.0-tuxcare.0 up to 0.1.0-tuxcare.1, plus listed versions 0.1.0 |
0.1.0-tuxcare.1 |
decompress-zipTuxCare:npm |
0.1.0-tuxcare.0 up to 0.1.0-tuxcare.1, plus listed versions 0.1.0 |
0.1.0-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16118 is a high vulnerability (CVSS 7.5) in Forwarded Project Forwarded, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in decompress-zip 0.2.2.
References
nodesecurity.io/advisories/527
securityfocus.com/bid/104427
github.com/nodejs/security-wg/blob/master/vuln/npm/488.json
snyk.io/research/zip-slip-vulnerability
npmjs.com/advisories/777
nvd.nist.gov/vuln/detail/CVE-2017-16118