Vulnerability Description
slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Slug Project | Slug | <= 0.9.1 |
Related Weaknesses (CWE)
References
- https://github.com/dodo/node-slug/issues/82Third Party Advisory
- https://nodesecurity.io/advisories/537Third Party Advisory
- https://github.com/dodo/node-slug/issues/82Third Party Advisory
- https://nodesecurity.io/advisories/537Third Party Advisory
FAQ
What is CVE-2017-16117?
CVE-2017-16117 is a vulnerability with a CVSS score of 7.5 (HIGH). slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k charact...
How severe is CVE-2017-16117?
CVE-2017-16117 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-16117?
Check the references section above for vendor advisories and patch information. Affected products include: Slug Project Slug.