Every CVESearch/Get API key

CVE-2017-20165

debug-js debug node.js useColors redos

3.5 LowPublic exploitFix available

CVE-2017-20165 is a low vulnerability (CVSS 3.5) in Debug-js Debug, published January 9, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in debug 2.6.9.

What does this mean?
Severity
3.5 LowCVSS 3.1, CVE List
Exploit chance
2.19%EPSS, 82nd percentile
Exploitation
None known1 public exploit
Fixed in
2.6.9debug +23 more

Description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

2.19%Up 1.2 points since Jan 10, 2023
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
debug
npm
before 2.6.9
2.6.9
debug
npm
3.0.0 up to 3.1.0
3.1.0
debug
TuxCare:npm
2.1.1-tuxcare.0 up to 2.1.1-tuxcare.1, plus listed versions
2.1.1
2.1.1-tuxcare.1
debug
TuxCare:npm
2.3.3-tuxcare.0 up to 2.3.3-tuxcare.2, plus listed versions
2.3.32.3.3-tuxcare.1
2.3.3-tuxcare.2
debug
TuxCare:npm
From an advisory covering 2 CVEs
1.0.5-tuxcare.0 up to 1.0.5-tuxcare.1, plus listed versions
1.0.5
1.0.5-tuxcare.1
debug
TuxCare:npm
From an advisory covering 2 CVEs
2.2.0-tuxcare.0 up to 2.2.0-tuxcare.1, plus listed versions
2.2.0
2.2.0-tuxcare.1
debug
TuxCare:npm
4.4.3-tuxcare.0 up to 4.4.3-tuxcare.3, plus listed versions
4.4.34.4.3-tuxcare.14.4.3-tuxcare.2
4.4.3-tuxcare.3
debug
TuxCare:npm
3.2.7-tuxcare.0 up to 3.2.7-tuxcare.3, plus listed versions
3.2.73.2.7-tuxcare.13.2.7-tuxcare.2
3.2.7-tuxcare.3
debug
TuxCare:npm
2.6.9-tuxcare.0 up to 2.6.9-tuxcare.2, plus listed versions
2.6.92.6.9-tuxcare.1
2.6.9-tuxcare.2
debug
TuxCare:npm
3.1.0-tuxcare.0 up to 3.1.0-tuxcare.2, plus listed versions
3.1.03.1.0-tuxcare.1
3.1.0-tuxcare.2
Show 14 moreShow less
Affected packages
PackageAffectedFixed
debug
TuxCare:npm
0.7.4-tuxcare.0 up to 0.7.4-tuxcare.1, plus listed versions
0.7.4
0.7.4-tuxcare.1
debug
TuxCare:npm
From an advisory covering 2 CVEs
2.6.4-tuxcare.0 up to 2.6.4-tuxcare.1, plus listed versions
2.6.4
2.6.4-tuxcare.1
debug
TuxCare:npm
2.1.0-tuxcare.0 up to 2.1.0-tuxcare.1, plus listed versions
2.1.0
2.1.0-tuxcare.1
debug
TuxCare:npm
1.0.4-tuxcare.0 up to 1.0.4-tuxcare.1, plus listed versions
1.0.4
1.0.4-tuxcare.1
debug
TuxCare:npm
1.0.3-tuxcare.0 up to 1.0.3-tuxcare.1, plus listed versions
1.0.3
1.0.3-tuxcare.1
debug
TuxCare:npm
1.0.2-tuxcare.0 up to 1.0.2-tuxcare.1, plus listed versions
1.0.2
1.0.2-tuxcare.1
debug
TuxCare:npm
From an advisory covering 2 CVEs
2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions
2.0.0
2.0.0-tuxcare.1
node-debug
Debian:12
before 3.1.0-1
3.1.0-1
node-debug
Debian:13
before 3.1.0-1
3.1.0-1
node-debug
Debian:14
before 3.1.0-1
3.1.0-1
@rootio/debug
Root:npm
before 2.2.0-root.io.1
2.2.0-root.io.1
debug
Root:npm
before 2.2.0-aikido.1
2.2.0-aikido.1
node-debug
Ubuntu:16.04:LTS
All versions, plus listed versions
2.1.0+dfsg-2
None known
node-debug
Ubuntu:18.04:LTS
All versions, plus listed versions
2.5.1-23.1.0-1
None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubfastify/send2023-01-11

What each source reports

CVE List Score used3.5

debug-js debug node.js useColors redos

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Record
CVE-2017-20165
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0
3.5 LowCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
2.7 AV:A/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2023-04343.5

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Record
EUVD-2023-0434
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-9vvw-cc9w-f27h7.5

debug Inefficient Regular Expression Complexity vulnerability

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.

Record
GHSA-9vvw-cc9w-f27h
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
NVD3.5

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Record
CVE-2017-20165
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
2.7 LowAV:A/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-1333
Updated
2026-11-02
OSV7.5

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Record
CVE-2017-20165
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-201657.5

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Record
DEBIAN-CVE-2017-20165
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 19 moreShow less
OSVGHSA-9vvw-cc9w-f27h7.5

debug Inefficient Regular Expression Complexity vulnerability

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.

Record
GHSA-9vvw-cc9w-f27h
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVUBUNTU-CVE-2017-201653.5

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Record
UBUNTU-CVE-2017-20165
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1772928826No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.1.1-tuxcare.1.

Record
CLSA-2026-1772928826
Updated
2026-11-02
OSVCLSA-2026-1773101692No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.3.3-tuxcare.2.

Record
CLSA-2026-1773101692
Updated
2026-11-02
OSVCLSA-2026-1773188146No score

TuxCare security update for diff (3 CVEs)

TuxCare rebuilt diff to address 3 CVEs. Fixed in 1.0.2-tuxcare.1.

Record
CLSA-2026-1773188146
Updated
2026-11-02
OSVCLSA-2026-1774225201No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 1.0.5-tuxcare.1.

Record
CLSA-2026-1774225201
Updated
2026-11-02
OSVCLSA-2026-1774225219No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.2.0-tuxcare.1.

Record
CLSA-2026-1774225219
Updated
2026-11-02
OSVCLSA-2026-1777077475No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 4.4.3-tuxcare.3.

Record
CLSA-2026-1777077475
Updated
2026-11-02
OSVCLSA-2026-1777077476No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 3.2.7-tuxcare.3.

Record
CLSA-2026-1777077476
Updated
2026-11-02
OSVCLSA-2026-1777077478No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.6.9-tuxcare.2.

Record
CLSA-2026-1777077478
Updated
2026-11-02
OSVCLSA-2026-1777077479No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 3.1.0-tuxcare.2.

Record
CLSA-2026-1777077479
Updated
2026-11-02
OSVCLSA-2026-1781484845No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 0.7.4-tuxcare.1.

Record
CLSA-2026-1781484845
Updated
2026-11-02
OSVCLSA-2026-1784596290No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.6.4-tuxcare.1.

Record
CLSA-2026-1784596290
Updated
2026-11-02
OSVCLSA-2026-1784596327No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.1.0-tuxcare.1.

Record
CLSA-2026-1784596327
Updated
2026-11-02
OSVCLSA-2026-1784682965No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.4-tuxcare.1.

Record
CLSA-2026-1784682965
Updated
2026-11-02
OSVCLSA-2026-1784683087No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.3-tuxcare.1.

Record
CLSA-2026-1784683087
Updated
2026-11-02
OSVCLSA-2026-1784769528No score

TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.2-tuxcare.1.

Record
CLSA-2026-1784769528
Updated
2026-11-02
OSVCLSA-2026-1792594199No score

TuxCare security update for debug (2 CVEs)

TuxCare rebuilt debug to address 2 CVEs. Fixed in 2.0.0-tuxcare.1.

Record
CLSA-2026-1792594199
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2017-20165No score

CVE-2017-20165 in @rootio/debug - Patched by Root

Root has patched CVE-2017-20165 in the @rootio/debug package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2017-20165
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open