{"id":"CVE-2017-16118","aliases":["AZL-44496","CLSA-2026-1773706635","CLSA-2026-1774225215","CLSA-2026-1774398084","EUVD-2018-0298","GHSA-73v8-v6g4-vrpm","GHSA-mpcf-4gmh-23w8"],"status":"published","title":"Arbitrary File Overwrite in decompress-zip","description":"The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01853,"percentile":0.79304,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-06-07T02:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"decompress-zip","fixed_in":["0.2.2","0.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"forwarded","fixed_in":["0.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"forwarded","fixed_in":["0.1.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"decompress-zip","fixed_in":["0.1.0-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"forwarded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"forwarded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"forwarded","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}]}],"products":[{"vendor":"forwarded_project","product":"forwarded"},{"vendor":"hackerone","product":"forwarded node module"}],"references":[{"url":"https://nodesecurity.io/advisories/527","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/104427","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://github.com/nodejs/security-wg/blob/master/vuln/npm/488.json","tags":["web"]},{"url":"https://snyk.io/research/zip-slip-vulnerability","tags":["web"]},{"url":"https://www.npmjs.com/advisories/777","tags":["web"]},{"url":"https://github.com/advisories/GHSA-73v8-v6g4-vrpm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16118","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mpcf-4gmh-23w8","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/527","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16118","description":"The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T01:06:51.232Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2018-0298","description":"The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T01:06:51Z","updated_at":"2026-11-03T00:28:52.69419Z"}],"ghsa":[{"id":"GHSA-mpcf-4gmh-23w8","title":"Regular Expression Denial of Service in forwarded","description":"Affected versions of `forwarded` are vulnerable to regular expression denial of service when parsing specially crafted user input.\n\n\n## Recommendation\n\nUpdate to version 0.1.2 or later","status":"published","published":"2018-07-24T20:16:30Z","modified":"2023-09-11T22:05:14Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:04.447845Z"},{"id":"GHSA-73v8-v6g4-vrpm","title":"Arbitrary File Overwrite in decompress-zip","description":"Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.\n\n\n\n## Recommendation\n\nFor `decompress-zip` 0.2.x upgrade to 0.2.2 or later.\nFor `decompress-zip` 0.3.x upgrade to 0.3.2 or later.","status":"published","published":"2020-09-02T15:58:13Z","modified":"2023-01-09T05:03:36Z","updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2017-16118","description":"The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:29:02.94Z","modified":"2026-06-17T01:08:49.727Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"AZL-44496","title":"CVE-2017-16118 affecting package nodejs-nodemon 2.0.3-5","description":"The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:29:02Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"GHSA-mpcf-4gmh-23w8","title":"Regular Expression Denial of Service in forwarded","description":"Affected versions of `forwarded` are vulnerable to regular expression denial of service when parsing specially crafted user input.\n\n\n## Recommendation\n\nUpdate to version 0.1.2 or later","status":"published","published":"2018-07-24T20:16:30Z","modified":"2023-11-08T03:59:05.893181Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"CLSA-2026-1773706635","title":"TuxCare security update for forwarded (1 CVE)","description":"TuxCare rebuilt forwarded to address 1 CVE. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.691331802Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225215","title":"TuxCare security update for decompress-zip (1 CVE)","description":"TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:47.954897089Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398084","title":"TuxCare security update for git-clone (5 CVEs)","description":"TuxCare rebuilt git-clone to address 5 CVEs. Fixed in 0.1.0-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:15Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"GHSA-73v8-v6g4-vrpm","title":"Arbitrary File Overwrite in decompress-zip","description":"Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.\n\n\n\n## Recommendation\n\nFor `decompress-zip` 0.2.x upgrade to 0.2.2 or later.\nFor `decompress-zip` 0.3.x upgrade to 0.3.2 or later.","status":"published","published":"2020-09-02T15:58:13Z","modified":"2020-08-31T18:35:21Z","updated_at":"2026-11-02T15:46:40.308826Z"}]}}