CVE-2017-20165 json
debug-js debug node.js useColors redos
published 2023-01-09 3 y ago modified 2026-06-17 4 mo ago also GHSA-9vvw-cc9w-f27h , EUVD-2023-0434
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Patch / fix
- npm debug 2.6.9, 3.1.0
- debug_project debug 2.6.9, 3.1.0
- github.com/debug-js/debug@c38a016 commit
- github.com/debug-js/debug@f53962e commit
- github.com/debug-js/debug#504 pull request
- github.com/debug-js/debug/releases/tag/3.1.0 release
- github.com/debug-js/debug/releases/tag/2.6.9 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 2.7 | AV:A/AC:L/Au:S/C:N/I:N/A:P |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | debug | >=3.0.0, <3.1.0 <2.6.9 |
3.1.0 2.6.9 |
Affected products
- debug-js debug
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/debug-js/debug/pull/504
issue-tracking, web, patch
-
github.com
/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685
patch, web
-
github.com
/debug-js/debug/releases/tag/3.1.0
patch, web, release-notes
-
github.com
/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a
web
-
vuldb.com
/?id.217665
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.217665
signature, permissions-required, web, third-party-advisory, vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2017-20165
advisory
-
github.com
/debug-js/debug
package
-
github.com
/debug-js/debug/releases/tag/2.6.9
web
Sources
- CVE List CVE-2017-20165
- GitHub Advisory GHSA-9vvw-cc9w-f27h
- NVD CVE-2017-20165
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.