---
title: "GHSA-9qj9-36jm-prpv: Regular Expression Denial of Service in fresh"
description: "High severity. Regular Expression Denial of Service in fresh. Affects fresh; fixed in 0.5.2."
url: https://inlinr.com/advisories/GHSA-9qj9-36jm-prpv
lang: en
---

[Packages](https://inlinr.com/packages) / [fresh](https://inlinr.com/packages/fresh) / [Security](https://inlinr.com/packages/fresh/security)

High Vulnerability GHSA-9qj9-36jm-prpv CVE-2017-16119 Published 24 Jul 2018

# Regular Expression Denial of Service in fresh

Your version 

Affected releases · [fresh](https://inlinr.com/packages/fresh)

- 0.5.x 0.5.0 – 0.5.1 Fixed in 0.5.2
- 0.4.x and older 0.0.1 – 0.4.0 No fix, no longer updated

On 0.5.x, the newest line:

```
npm install fresh@0.5.2
```

Every release on a timeline

2.x 

1. Not affected

2.0.0  
1 release

0.x 

1. Affected

0.0.1 – 0.5.1  
11 releases
2. Fixed

0.5.2  
1 release, latest

14 stable releases of fresh, oldest to newest, one row per major.

## What happens

Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.

Recommendation

Update to version 0.5.2 or later.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-16119 "https://nvd.nist.gov/vuln/detail/CVE-2017-16119")  
nvd.nist.gov/vuln/detail/CVE-2017-16119
- [GitHub advisory](https://github.com/advisories/GHSA-9qj9-36jm-prpv "https://github.com/advisories/GHSA-9qj9-36jm-prpv")  
github.com/advisories/GHSA-9qj9-36jm-prpv
- [Reference](https://www.npmjs.com/advisories/526 "https://www.npmjs.com/advisories/526")  
npmjs.com/advisories/526