{"id":"CVE-2017-16117","aliases":["EUVD-2018-0292","GHSA-jxqq-cqm6-pfq9"],"status":"published","title":"Regular Expression Denial of Service in slug","description":"slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01559,"percentile":0.7539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-06-07T02:00:00Z","modified":"2026-10-20T10:47:46Z","fixes":[{"ecosystem":"npm","package":"slug","fixed_in":["0.9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"slug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.1"},{"fixed":"0.9.2"}]}]},{"source":"osv","ecosystem":"npm","package":"slug","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}]}],"products":[{"vendor":"hackerone","product":"slug node module"},{"vendor":"slug_project","product":"slug"}],"references":[{"url":"https://github.com/dodo/node-slug/issues/82","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nodesecurity.io/advisories/537","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16117","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jxqq-cqm6-pfq9","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/537","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16117","description":"slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T01:16:46.857Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2018-0292","description":"slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T01:16:46Z","updated_at":"2026-11-03T00:28:51.310992Z"}],"ghsa":[{"id":"GHSA-jxqq-cqm6-pfq9","title":"Regular Expression Denial of Service in slug","description":"Affected versions of `slug` are vulnerable to a regular expression denial of service when parsing untrusted user input.\n\nThe issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds,\n\nAbout 50k characters can block the event loop for 2 seconds.\n\n\n## Recommendation\n\nUpdate to version 0.9.2 or later.","status":"published","published":"2018-07-24T20:06:45Z","modified":"2023-01-12T05:04:56Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:14.033357Z"}],"nvd":[{"id":"CVE-2017-16117","description":"slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.","status":"published","published":"2018-06-07T02:29:02.91Z","modified":"2026-06-17T01:08:49.61Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-16117","description":"slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.","status":"published","published":"2018-06-07T02:29:02.91Z","modified":"2026-10-20T10:47:46.989420531Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"GHSA-jxqq-cqm6-pfq9","title":"Regular Expression Denial of Service in slug","description":"Affected versions of `slug` are vulnerable to a regular expression denial of service when parsing untrusted user input.\n\nThe issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds,\n\nAbout 50k characters can block the event loop for 2 seconds.\n\n\n## Recommendation\n\nUpdate to version 0.9.2 or later.","status":"published","published":"2018-07-24T20:06:45Z","modified":"2023-11-08T03:59:05.830201Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:51.10002Z"}]}}