---
title: "GHSA-9vvw-cc9w-f27h: debug Inefficient Regular Expression Complexity vulnerability"
description: "High severity. debug Inefficient Regular Expression Complexity vulnerability. Affects debug; fixed in 3.1.0."
url: https://inlinr.com/advisories/GHSA-9vvw-cc9w-f27h
lang: en
---

[Packages](https://inlinr.com/packages) / [debug](https://inlinr.com/packages/debug) / [Security](https://inlinr.com/packages/debug/security)

High Vulnerability GHSA-9vvw-cc9w-f27h CVE-2017-20165 Published 9 Jan 2023

# debug Inefficient Regular Expression Complexity vulnerability

Your version 

Affected releases · [debug](https://inlinr.com/packages/debug)

- 3.x 3.0.0 – 3.0.1 Fixed in 3.1.0
- 2.x 2.0.0 – 2.6.8 Fixed in 2.6.9
- 1.x and older 0.0.1 – 1.0.5 No fix, no longer updated

On 3.x, the newest line:

```
npm install debug@3.1.0
```

Every release on a timeline

4.x 

1. Not affected

4.0.0 – 4.4.3  
17 releases, latest

3.x 

1. Affected

3.0.0 – 3.0.1  
2 releases
2. Fixed

3.1.0 – 3.2.7  
9 releases

2.x 

1. Affected

2.0.0 – 2.6.8  
28 releases
2. Fixed

2.6.9  
1 release

1.x 

1. Affected

1.0.0 – 1.0.5  
6 releases

0.x 

1. Affected

0.0.1 – 0.8.1  
15 releases

78 stable releases of debug, oldest to newest, one row per major.

## What happens

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is [c38a016](https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685). It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-20165 "https://nvd.nist.gov/vuln/detail/CVE-2017-20165")  
nvd.nist.gov/vuln/detail/CVE-2017-20165
- [Pull request](https://github.com/debug-js/debug/pull/504 "https://github.com/debug-js/debug/pull/504")  
#504
- [Fix commit](https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685 "https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685")  
c38a016
- [Fix commit](https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a "https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a")  
f53962e
- [Package](https://github.com/debug-js/debug "https://github.com/debug-js/debug")  
github.com/debug-js/debug
- [Reference](https://github.com/debug-js/debug/releases/tag/2.6.9 "https://github.com/debug-js/debug/releases/tag/2.6.9")  
github.com/debug-js/debug/releases/tag/2.6.9
- [Reference](https://github.com/debug-js/debug/releases/tag/3.1.0 "https://github.com/debug-js/debug/releases/tag/3.1.0")  
github.com/debug-js/debug/releases/tag/3.1.0
- [Reference](https://vuldb.com/?ctiid.217665 "https://vuldb.com/?ctiid.217665")  
vuldb.com
- [Reference](https://vuldb.com/?id.217665 "https://vuldb.com/?id.217665")  
vuldb.com