debug Inefficient Regular Expression Complexity vulnerability

ÉLEVÉE 7.5CVE-2017-20165 · GHSA-9vvw-cc9w-f27h · Published 09/01/2023 · updated 17/06/2026

En bref

CVE-2017-20165 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant debug (debug project), debug.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.1%, plus élevée que 81.8% des vulnérabilités.
Correctif : mettre à jour vers 3.1.0, 2.6.9 ou plus récent.

Package	Affected versions	Patched versions
debug debug_project	`≥ 3.0.0, < 3.1.0< 2.6.9`	`3.1.02.6.9`
debug npm	`≥ 3.0.0, < 3.1.0< 2.6.9`	`3.1.02.6.9`

Description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.

NVD description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2017-20165 · ADVISORY
debug-js/debug#504 · WEB
debug-js/debug commit c38a016 · WEB
debug-js/debug commit f53962e · WEB
debug-js/debug · PACKAGE
debug-js/debug release 2.6.9 · WEB
debug-js/debug release 3.1.0 · WEB
vuldb.com · WEB
vuldb.com · WEB

Autres vulnérabilités de debug

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

debug

debug_project

≥ 3.0.0, < 3.1.0< 2.6.9

3.1.02.6.9

debug

npm

≥ 3.0.0, < 3.1.0< 2.6.9

3.1.02.6.9

Description

NVD description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.