CVE-2017-16119
Arbitrary File Overwrite in decompress-zip
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
CVE-2017-16119- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0256
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
EUVD-2018-0256- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9qj9-36jm-prpv
Regular Expression Denial of Service in fresh
Affected versions of fresh are vulnerable to regular expression denial of service when parsing specially crafted user input.
Recommendation
Update to version 0.5.2 or later.
- Record
GHSA-9qj9-36jm-prpv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-73v8-v6g4-vrpm No score
Arbitrary File Overwrite in decompress-zip
Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory.
Recommendation
For decompress-zip 0.2.x upgrade to 0.2.2 or later.
For decompress-zip 0.3.x upgrade to 0.3.2 or later.
- Record
GHSA-73v8-v6g4-vrpm- Updated
- 2026-11-02
NVD
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
CVE-2017-16119- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVAZL-44892
CVE-2017-16119 affecting package nodejs-nodemon 2.0.3-5
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
AZL-44892- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 14 moreShow less
OSV
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
CVE-2017-16119- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16119
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
DEBIAN-CVE-2017-16119- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-9qj9-36jm-prpv
Regular Expression Denial of Service in fresh
Affected versions of fresh are vulnerable to regular expression denial of service when parsing specially crafted user input.
Recommendation
Update to version 0.5.2 or later.
- Record
GHSA-9qj9-36jm-prpv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16119
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
- Record
UBUNTU-CVE-2017-16119- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1771805410 No score
TuxCare security update for fresh (1 CVE)
TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.3.0-tuxcare.1.
- Record
CLSA-2026-1771805410- Updated
- 2026-11-02
OSVCLSA-2026-1773706628 No score
TuxCare security update for fresh (1 CVE)
TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.2.4-tuxcare.1.
- Record
CLSA-2026-1773706628- Updated
- 2026-11-02
OSVCLSA-2026-1774225215 No score
TuxCare security update for decompress-zip (1 CVE)
TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1.
- Record
CLSA-2026-1774225215- Updated
- 2026-11-02
OSVCLSA-2026-1774398084 No score
TuxCare security update for git-clone (5 CVEs)
TuxCare rebuilt git-clone to address 5 CVEs. Fixed in 0.1.0-tuxcare.1.
- Record
CLSA-2026-1774398084- Updated
- 2026-11-02
OSVCLSA-2026-1774484503 No score
TuxCare security update for minimatch (2 CVEs)
TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.3.0-tuxcare.1.
- Record
CLSA-2026-1774484503- Updated
- 2026-11-02
OSVCLSA-2026-1784596355 No score
TuxCare security update for fresh (1 CVE)
TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.1.0-tuxcare.1.
- Record
CLSA-2026-1784596355- Updated
- 2026-11-02
OSVCLSA-2026-1784769497 No score
TuxCare security update for fresh (1 CVE)
TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.2.0-tuxcare.1.
- Record
CLSA-2026-1784769497- Updated
- 2026-11-02
OSVCLSA-2026-1789159763 No score
TuxCare security update for fresh (1 CVE)
TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.2.2-tuxcare.1.
- Record
CLSA-2026-1789159763- Updated
- 2026-11-02
OSVGHSA-73v8-v6g4-vrpm No score
Arbitrary File Overwrite in decompress-zip
Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory.
Recommendation
For decompress-zip 0.2.x upgrade to 0.2.2 or later.
For decompress-zip 0.3.x upgrade to 0.3.2 or later.
- Record
GHSA-73v8-v6g4-vrpm- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2017-16119 No score
CVE-2017-16119 in fresh - Patched by Root
Root has patched CVE-2017-16119 in the fresh package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2017-16119- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
decompress-zipnpm |
before 0.2.2 | 0.2.2 |
decompress-zipnpm |
0.3.0 up to 0.3.2 | 0.3.2 |
freshnpm |
before 0.5.2 | 0.5.2 |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
freshTuxCare:npm |
0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions 0.3.0 |
0.3.0-tuxcare.1 |
freshTuxCare:npm |
0.2.4-tuxcare.0 up to 0.2.4-tuxcare.1, plus listed versions 0.2.4 |
0.2.4-tuxcare.1 |
decompress-zipTuxCare:npm |
0.1.0-tuxcare.0 up to 0.1.0-tuxcare.1, plus listed versions 0.1.0 |
0.1.0-tuxcare.1 |
minimatchTuxCare:npm |
0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions 0.3.0 |
0.3.0-tuxcare.1 |
freshTuxCare:npm |
0.1.0-tuxcare.0 up to 0.1.0-tuxcare.1, plus listed versions 0.1.0 |
0.1.0-tuxcare.1 |
freshTuxCare:npm |
0.2.0-tuxcare.0 up to 0.2.0-tuxcare.1, plus listed versions 0.2.0 |
0.2.0-tuxcare.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
freshTuxCare:npm |
0.2.2-tuxcare.0 up to 0.2.2-tuxcare.1, plus listed versions 0.2.2 |
0.2.2-tuxcare.1 |
node-freshDebian:12 |
before 0.2.0-2 | 0.2.0-2 |
node-freshDebian:13 |
before 0.2.0-2 | 0.2.0-2 |
node-freshDebian:14 |
before 0.2.0-2 | 0.2.0-2 |
freshRoot:npm |
before 0.3.0-aikido.1 | 0.3.0-aikido.1 |
@rootio/freshRoot:npm |
before 0.3.0-root.io.1 | 0.3.0-root.io.1 |
node-freshUbuntu:16.04:LTS |
All versions, plus listed versions 0.2.0-1 |
None known |
node-freshUbuntu:18.04:LTS |
All versions, plus listed versions 0.2.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16119 is a high vulnerability (CVSS 7.5) in Fresh Project Fresh, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in decompress-zip 0.2.2.