---
title: "GHSA-gxpj-cx7g-858c: Regular Expression Denial of Service in debug"
description: "Low severity. Regular Expression Denial of Service in debug. Affects debug; fixed in 4.3.1."
url: https://inlinr.com/advisories/GHSA-gxpj-cx7g-858c
lang: en
---

[Packages](https://inlinr.com/packages) / [debug](https://inlinr.com/packages/debug) / [Security](https://inlinr.com/packages/debug/security)

Low Vulnerability GHSA-gxpj-cx7g-858c CVE-2017-16137 Published 9 Aug 2018

# Regular Expression Denial of Service in debug

Your version 

Affected releases · [debug](https://inlinr.com/packages/debug)

- 4.x 4.0.0 – 4.3.0 Fixed in 4.3.1
- 3.x 3.0.0 – 3.2.6 Fixed in 3.2.7
- 2.x 2.0.0 – 2.6.8 Fixed in 2.6.9
- 1.x and older 0.0.1 – 1.0.5 No fix, no longer updated

On 4.x, the newest line:

```
npm install debug@4.3.1
```

Every release on a timeline

4.x 

1. Affected

4.0.0 – 4.3.0  
6 releases
2. Fixed

4.3.1 – 4.4.3  
11 releases, latest

3.x 

1. Affected

3.0.0 – 3.0.1  
2 releases
2. Fixed

3.1.0  
1 release
3. Affected

3.2.0 – 3.2.6  
7 releases
4. Fixed

3.2.7  
1 release

2.x 

1. Affected

2.0.0 – 2.6.8  
28 releases
2. Fixed

2.6.9  
1 release

1.x 

1. Affected

1.0.0 – 1.0.5  
6 releases

0.x 

1. Affected

0.0.1 – 0.8.1  
15 releases

78 stable releases of debug, oldest to newest, one row per major.

## What happens

Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. 

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.

Recommendation

Version 2.x.x: Update to version 2.6.9 or later. Version 3.1.x: Update to version 3.1.0 or later. Version 3.2.x: Update to version 3.2.7 or later. Version 4.x.x: Update to version 4.3.1 or later.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-16137 "https://nvd.nist.gov/vuln/detail/CVE-2017-16137")  
nvd.nist.gov/vuln/detail/CVE-2017-16137
- [Issue](https://github.com/debug-js/debug/issues/797 "https://github.com/debug-js/debug/issues/797")  
#797
- [Issue](https://github.com/visionmedia/debug/issues/501 "https://github.com/visionmedia/debug/issues/501")  
#501
- [Pull request](https://github.com/visionmedia/debug/pull/504 "https://github.com/visionmedia/debug/pull/504")  
#504
- [Fix commit](https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020 "https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020")  
4e21502
- [Fix commit](https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290 "https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290")  
7116906
- [Fix commit](https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac "https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac")  
b6d12fd
- [Fix commit](https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a "https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a")  
f53962e
- [Package](https://github.com/visionmedia/debug "https://github.com/visionmedia/debug")  
github.com/visionmedia/debug
- [Reference](https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E "https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E")  
lists.apache.org/thread.html/r8ba4c628fba7181af…
- [Reference](https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E "https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E")  
lists.apache.org/thread.html/rb5ac16fad337d1f3b…