CVE-2017-16117 Regular Expression Denial of Service in slug
Attackers can cause denial of service in applications using the slug library by submitting specially crafted strings that block the event loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16117?
CVE-2017-16117 is a high-severity denial of service vulnerability in HackerOne slug node module, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.
Weakness: CWE-400
Which versions are affected by CVE-2017-16117?
2 open source packages ship an affected version, including slug. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slug npm | All versions | 0.9.2 |
slug npm | All versions | 0.9.2 |
Products include Slug Project Slug.
How do I fix CVE-2017-16117?
Upgrade slug to 0.9.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-16117 being exploited?
There is no known exploitation of CVE-2017-16117 in the wild and no public exploit code.
Sources
Also known as GHSA-jxqq-cqm6-pfq9.