CVE-2017-20165
debug-js debug node.js useColors redos
CVE-2017-20165 is a low vulnerability (CVSS 3.5) in Debug-js Debug, published January 9, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in debug 2.6.9.
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
debug-js debug node.js useColors redos
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Record
CVE-2017-20165- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 2.7
AV:A/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2023-0434
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Record
EUVD-2023-0434- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9vvw-cc9w-f27h
debug Inefficient Regular Expression Complexity vulnerability
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.
- Record
GHSA-9vvw-cc9w-f27h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Record
CVE-2017-20165- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.7 Low
AV:A/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Record
CVE-2017-20165- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-20165
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Record
DEBIAN-CVE-2017-20165- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 19 moreShow less
OSVGHSA-9vvw-cc9w-f27h
debug Inefficient Regular Expression Complexity vulnerability
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.
- Record
GHSA-9vvw-cc9w-f27h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-20165
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Record
UBUNTU-CVE-2017-20165- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1772928826 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 2.1.1-tuxcare.1.
- Record
CLSA-2026-1772928826- Updated
- 2026-11-02
OSVCLSA-2026-1773101692 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 2.3.3-tuxcare.2.
- Record
CLSA-2026-1773101692- Updated
- 2026-11-02
OSVCLSA-2026-1773188146 No score
TuxCare security update for diff (3 CVEs)
TuxCare rebuilt diff to address 3 CVEs. Fixed in 1.0.2-tuxcare.1.
- Record
CLSA-2026-1773188146- Updated
- 2026-11-02
OSVCLSA-2026-1774225201 No score
TuxCare security update for debug (2 CVEs)
TuxCare rebuilt debug to address 2 CVEs. Fixed in 1.0.5-tuxcare.1.
- Record
CLSA-2026-1774225201- Updated
- 2026-11-02
OSVCLSA-2026-1774225219 No score
TuxCare security update for debug (2 CVEs)
TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.2.0-tuxcare.1.
- Record
CLSA-2026-1774225219- Updated
- 2026-11-02
OSVCLSA-2026-1777077475 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 4.4.3-tuxcare.3.
- Record
CLSA-2026-1777077475- Updated
- 2026-11-02
OSVCLSA-2026-1777077476 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 3.2.7-tuxcare.3.
- Record
CLSA-2026-1777077476- Updated
- 2026-11-02
OSVCLSA-2026-1777077478 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 2.6.9-tuxcare.2.
- Record
CLSA-2026-1777077478- Updated
- 2026-11-02
OSVCLSA-2026-1777077479 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 3.1.0-tuxcare.2.
- Record
CLSA-2026-1777077479- Updated
- 2026-11-02
OSVCLSA-2026-1781484845 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 0.7.4-tuxcare.1.
- Record
CLSA-2026-1781484845- Updated
- 2026-11-02
OSVCLSA-2026-1784596290 No score
TuxCare security update for debug (2 CVEs)
TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.6.4-tuxcare.1.
- Record
CLSA-2026-1784596290- Updated
- 2026-11-02
OSVCLSA-2026-1784596327 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 2.1.0-tuxcare.1.
- Record
CLSA-2026-1784596327- Updated
- 2026-11-02
OSVCLSA-2026-1784682965 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.4-tuxcare.1.
- Record
CLSA-2026-1784682965- Updated
- 2026-11-02
OSVCLSA-2026-1784683087 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.3-tuxcare.1.
- Record
CLSA-2026-1784683087- Updated
- 2026-11-02
OSVCLSA-2026-1784769528 No score
TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.2-tuxcare.1.
- Record
CLSA-2026-1784769528- Updated
- 2026-11-02
OSVCLSA-2026-1792594199 No score
TuxCare security update for debug (2 CVEs)
TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.0.0-tuxcare.1.
- Record
CLSA-2026-1792594199- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2017-20165 No score
CVE-2017-20165 in @rootio/debug - Patched by Root
Root has patched CVE-2017-20165 in the @rootio/debug package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2017-20165- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
debugnpm |
before 2.6.9 | 2.6.9 |
debugnpm |
3.0.0 up to 3.1.0 | 3.1.0 |
debugTuxCare:npm |
2.1.1-tuxcare.0 up to 2.1.1-tuxcare.1, plus listed versions 2.1.1 |
2.1.1-tuxcare.1 |
debugTuxCare:npm |
2.3.3-tuxcare.0 up to 2.3.3-tuxcare.2, plus listed versions 2.3.32.3.3-tuxcare.1 |
2.3.3-tuxcare.2 |
debugTuxCare:npm |
1.0.5-tuxcare.0 up to 1.0.5-tuxcare.1, plus listed versions 1.0.5 |
1.0.5-tuxcare.1 |
debugTuxCare:npm |
2.2.0-tuxcare.0 up to 2.2.0-tuxcare.1, plus listed versions 2.2.0 |
2.2.0-tuxcare.1 |
debugTuxCare:npm |
4.4.3-tuxcare.0 up to 4.4.3-tuxcare.3, plus listed versions 4.4.34.4.3-tuxcare.14.4.3-tuxcare.2 |
4.4.3-tuxcare.3 |
debugTuxCare:npm |
3.2.7-tuxcare.0 up to 3.2.7-tuxcare.3, plus listed versions 3.2.73.2.7-tuxcare.13.2.7-tuxcare.2 |
3.2.7-tuxcare.3 |
debugTuxCare:npm |
2.6.9-tuxcare.0 up to 2.6.9-tuxcare.2, plus listed versions 2.6.92.6.9-tuxcare.1 |
2.6.9-tuxcare.2 |
debugTuxCare:npm |
3.1.0-tuxcare.0 up to 3.1.0-tuxcare.2, plus listed versions 3.1.03.1.0-tuxcare.1 |
3.1.0-tuxcare.2 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
debugTuxCare:npm |
0.7.4-tuxcare.0 up to 0.7.4-tuxcare.1, plus listed versions 0.7.4 |
0.7.4-tuxcare.1 |
debugTuxCare:npm |
2.6.4-tuxcare.0 up to 2.6.4-tuxcare.1, plus listed versions 2.6.4 |
2.6.4-tuxcare.1 |
debugTuxCare:npm |
2.1.0-tuxcare.0 up to 2.1.0-tuxcare.1, plus listed versions 2.1.0 |
2.1.0-tuxcare.1 |
debugTuxCare:npm |
1.0.4-tuxcare.0 up to 1.0.4-tuxcare.1, plus listed versions 1.0.4 |
1.0.4-tuxcare.1 |
debugTuxCare:npm |
1.0.3-tuxcare.0 up to 1.0.3-tuxcare.1, plus listed versions 1.0.3 |
1.0.3-tuxcare.1 |
debugTuxCare:npm |
1.0.2-tuxcare.0 up to 1.0.2-tuxcare.1, plus listed versions 1.0.2 |
1.0.2-tuxcare.1 |
debugTuxCare:npm |
2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions 2.0.0 |
2.0.0-tuxcare.1 |
node-debugDebian:12 |
before 3.1.0-1 | 3.1.0-1 |
node-debugDebian:13 |
before 3.1.0-1 | 3.1.0-1 |
node-debugDebian:14 |
before 3.1.0-1 | 3.1.0-1 |
@rootio/debugRoot:npm |
before 2.2.0-root.io.1 | 2.2.0-root.io.1 |
debugRoot:npm |
before 2.2.0-aikido.1 | 2.2.0-aikido.1 |
node-debugUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.0+dfsg-2 |
None known |
node-debugUbuntu:18.04:LTS |
All versions, plus listed versions 2.5.1-23.1.0-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | fastify/send | 2023-01-11 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
vuldb.com?id.217665
github.com/debug-js/debug/pull/504
nvd.nist.gov/vuln/detail/CVE-2017-20165
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2017-20165
ubuntu.com/security/CVE-2017-20165
cve.org/CVERecord?id=CVE-2017-20165