CVE-2017-20162 json
vercel ms index.js parse redos
published 2023-01-05 3 y ago modified 2026-10-15 25 d ago also GHSA-w9mr-4mfr-499f , EUVD-2023-0571
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
Patch / fix
- npm ms 2.0.0
- vercel ms 2.0.0
- github.com/vercel/ms@caae298 commit
- github.com/vercel/ms#89 pull request
- github.com/vercel/ms/releases/tag/2.0.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 25 d ago
Exploit prediction
1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/vercel/ms/pull/89 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:N/A:P |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ms | <2.0.0 |
2.0.0 |
Affected products
- vercel ms
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/vercel/ms/pull/89
exploit, issue-tracking, web, patch
-
github.com
/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662
patch, web
-
github.com
/vercel/ms/releases/tag/2.0.0
patch, web, release-notes
-
vuldb.com
/?id.217451
vdb-entry, technical-description, web, permissions-required, third-party-advisory
-
vuldb.com
/?ctiid.217451
signature, permissions-required, web, third-party-advisory
- security.netapp.com /advisory/ntap-20241108-0002/
-
nvd.nist.gov
/vuln/detail/CVE-2017-20162
advisory
-
github.com
/vercel/ms
package
-
security.netapp.com
/advisory/ntap-20241108-0002
web
Sources
- CVE List CVE-2017-20162
- GitHub Advisory GHSA-w9mr-4mfr-499f
- NVD CVE-2017-20162
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.