{"id":"CVE-2017-16119","aliases":["AZL-44892","CLSA-2026-1771805410","CLSA-2026-1773706628","CLSA-2026-1774225215","CLSA-2026-1774398084","CLSA-2026-1774484503","CLSA-2026-1784596355","CLSA-2026-1784769497","CLSA-2026-1789159763","DEBIAN-CVE-2017-16119","EUVD-2018-0256","GHSA-73v8-v6g4-vrpm","GHSA-9qj9-36jm-prpv","ROOT-APP-NPM-CVE-2017-16119","UBUNTU-CVE-2017-16119"],"status":"published","title":"Arbitrary File Overwrite in decompress-zip","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01573,"percentile":0.75588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-06-07T02:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"decompress-zip","fixed_in":["0.2.2","0.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"fresh","fixed_in":["0.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fresh","fixed_in":["0.3.0-tuxcare.1","0.2.4-tuxcare.1","0.1.0-tuxcare.1","0.2.0-tuxcare.1","0.2.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"decompress-zip","fixed_in":["0.1.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-fresh","fixed_in":["0.2.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-fresh","fixed_in":["0.2.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-fresh","fixed_in":["0.2.0-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"fresh","fixed_in":["0.3.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fresh","fixed_in":["0.3.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0-tuxcare.0"},{"fixed":"0.3.0-tuxcare.1"}]}],"versions":["0.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.4-tuxcare.0"},{"fixed":"0.2.4-tuxcare.1"}]}],"versions":["0.2.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0-tuxcare.0"},{"fixed":"0.3.0-tuxcare.1"}]}],"versions":["0.3.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0-tuxcare.0"},{"fixed":"0.2.0-tuxcare.1"}]}],"versions":["0.2.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.2-tuxcare.0"},{"fixed":"0.2.2-tuxcare.1"}]}],"versions":["0.2.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2"}]}]},{"source":"osv","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"fresh","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-fresh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.0-1"]}],"products":[{"vendor":"fresh_project","product":"fresh"},{"vendor":"hackerone","product":"fresh node module"}],"references":[{"url":"https://nodesecurity.io/advisories/526","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/nodejs/security-wg/blob/master/vuln/npm/488.json","tags":["web"]},{"url":"https://snyk.io/research/zip-slip-vulnerability","tags":["web"]},{"url":"https://www.npmjs.com/advisories/777","tags":["web"]},{"url":"https://github.com/advisories/GHSA-73v8-v6g4-vrpm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16119","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9qj9-36jm-prpv","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/526","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16119","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-16119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16119","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-16119","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2026-10-08T19:43:05.054Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2018-0256","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2026-10-08T19:43:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:27.72962Z"}],"ghsa":[{"id":"GHSA-9qj9-36jm-prpv","title":"Regular Expression Denial of Service in fresh","description":"Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.\n\n\n## Recommendation\n\nUpdate to version 0.5.2 or later.","status":"published","published":"2018-07-24T20:16:57Z","modified":"2023-09-08T21:32:06Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:03.287418Z"},{"id":"GHSA-73v8-v6g4-vrpm","title":"Arbitrary File Overwrite in decompress-zip","description":"Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.\n\n\n\n## Recommendation\n\nFor `decompress-zip` 0.2.x upgrade to 0.2.2 or later.\nFor `decompress-zip` 0.3.x upgrade to 0.3.2 or later.","status":"published","published":"2020-09-02T15:58:13Z","modified":"2023-01-09T05:03:36Z","updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2017-16119","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:29:02.987Z","modified":"2026-10-08T20:17:26.467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"AZL-44892","title":"CVE-2017-16119 affecting package nodejs-nodemon 2.0.3-5","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:29:02Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2017-16119","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:29:02.987Z","modified":"2026-03-13T23:33:48.533084Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16119","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:29:02.987Z","modified":"2026-10-09T09:47:28.044275971Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"GHSA-9qj9-36jm-prpv","title":"Regular Expression Denial of Service in fresh","description":"Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.\n\n\n## Recommendation\n\nUpdate to version 0.5.2 or later.","status":"published","published":"2018-07-24T20:16:57Z","modified":"2023-11-08T03:59:05.953225Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"UBUNTU-CVE-2017-16119","description":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.","status":"published","published":"2018-06-07T02:29:00Z","modified":"2026-10-12T14:20:19.770272567Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"CLSA-2026-1771805410","title":"TuxCare security update for fresh (1 CVE)","description":"TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.462159426Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773706628","title":"TuxCare security update for fresh (1 CVE)","description":"TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.2.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.693504629Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225215","title":"TuxCare security update for decompress-zip (1 CVE)","description":"TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:47.954897089Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398084","title":"TuxCare security update for git-clone (5 CVEs)","description":"TuxCare rebuilt git-clone to address 5 CVEs. Fixed in 0.1.0-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:15Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774484503","title":"TuxCare security update for minimatch (2 CVEs)","description":"TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-22T14:30:59.641438887Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1784596355","title":"TuxCare security update for fresh (1 CVE)","description":"TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:46Z","modified":"2026-10-15T09:47:54.078845907Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769497","title":"TuxCare security update for fresh (1 CVE)","description":"TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.258805627Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1789159763","title":"TuxCare security update for fresh (1 CVE)","description":"TuxCare rebuilt fresh to address 1 CVE. Fixed in 0.2.2-tuxcare.1.","status":"published","published":"2026-09-11T20:49:23Z","modified":"2026-10-15T09:48:03.955886764Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"GHSA-73v8-v6g4-vrpm","title":"Arbitrary File Overwrite in decompress-zip","description":"Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.\n\n\n\n## Recommendation\n\nFor `decompress-zip` 0.2.x upgrade to 0.2.2 or later.\nFor `decompress-zip` 0.3.x upgrade to 0.3.2 or later.","status":"published","published":"2020-09-02T15:58:13Z","modified":"2020-08-31T18:35:21Z","updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"ROOT-APP-NPM-CVE-2017-16119","title":"CVE-2017-16119 in fresh - Patched by Root","description":"Root has patched CVE-2017-16119 in the fresh package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-13T05:07:21Z","modified":"2026-08-13T07:45:09.130680945Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}