CVE-2017-16119 Regular Expression Denial of Service in fresh
Attackers can cause a denial of service in applications using the Fresh module by sending specially crafted input that blocks the event loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16119?
CVE-2017-16119 is a high-severity denial of service vulnerability in HackerOne fresh node module, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Weakness: CWE-400
Which versions are affected by CVE-2017-16119?
2 open source packages ship an affected version, including fresh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fresh npm | All versions | 0.5.2 |
fresh npm | All versions | 0.5.2 |
Products include Fresh Project Fresh.
How do I fix CVE-2017-16119?
Upgrade fresh to 0.5.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-16119 being exploited?
There is no known exploitation of CVE-2017-16119 in the wild and no public exploit code.
Sources
Also known as AZL-44892, CLSA-2026-1771805410, CLSA-2026-1773706628, CLSA-2026-1784596355, CLSA-2026-1784769497, CLSA-2026-1789159763 and 4 more.