CVE-2017-16129

2018-04-2600:00:00

CWE-409

hackerone

www.cve.org

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.3%

JSON

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

CNA Affected

[
  {
    "product": "superagent node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<3.7.0"
      }
    ]
  }
]