CVE-2017-16137

MediumCVSS 5.3

Published: 07/06/2018(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.83%

86th percentile - higher than 86% of all known CVEs

Summary

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Risk Assessment

An attacker can remotely cause a temporary application hang by sending specially crafted input, potentially leading to partial denial of service.

Recommendation

Update the debug module to a version that fixes this vulnerability, or avoid passing untrusted data to the o formatter.

Other vulnerabilities in debug

CVE-2025-59144High
debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local, server, and CLI environments are not affected. If the package was used in a browser context, there is a chance the malware still exists and such bundles will need to be rebuilt. npm removed the package, and the owner published new patch versions. Users should upgrade to the latest patch version, remove node_modules, clean the package manager's cache, and rebuild browser bundles from scratch.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS