CVE-2017-16117

2018-04-2600:00:00

CWE-400

hackerone

www.cve.org

0.001 Low

EPSS

Percentile

43.2%

JSON

slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.

CNA Affected

[
  {
    "product": "slug node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

github.com/dodo/node-slug/issues/82

nodesecurity.io/advisories/537

0.001 Low

EPSS

Percentile

43.2%

JSON

Related for CVELIST:CVE-2017-16117