---
title: "GHSA-mpcf-4gmh-23w8: Regular Expression Denial of Service in forwarded"
description: "High severity. Regular Expression Denial of Service in forwarded. Affects forwarded; fixed in 0.1.2."
url: https://inlinr.com/advisories/GHSA-mpcf-4gmh-23w8
lang: en
---

[Packages](https://inlinr.com/packages) / [forwarded](https://inlinr.com/packages/forwarded) / [Security](https://inlinr.com/packages/forwarded/security)

High Vulnerability GHSA-mpcf-4gmh-23w8 CVE-2017-16118 Published 24 Jul 2018

# Regular Expression Denial of Service in forwarded

Your version 

Affected releases · [forwarded](https://inlinr.com/packages/forwarded)

- 0.1.x 0.1.0 – 0.1.1 Fixed in 0.1.2
- 0.0.x 0.0.0 No fix on this line yet

On 0.1.x, the newest line:

```
npm install forwarded@0.1.2
```

Every release on a timeline

1. Affected

0.0.0 – 0.1.1  
3 releases
2. Fixed

0.1.2 – 0.2.0  
2 releases, latest

5 stable releases of forwarded, oldest to newest.

## What happens

Affected versions of `forwarded` are vulnerable to regular expression denial of service when parsing specially crafted user input.

Recommendation

Update to version 0.1.2 or later

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-16118 "https://nvd.nist.gov/vuln/detail/CVE-2017-16118")  
nvd.nist.gov/vuln/detail/CVE-2017-16118
- [GitHub advisory](https://github.com/advisories/GHSA-mpcf-4gmh-23w8 "https://github.com/advisories/GHSA-mpcf-4gmh-23w8")  
github.com/advisories/GHSA-mpcf-4gmh-23w8
- [Reference](https://www.npmjs.com/advisories/527 "https://www.npmjs.com/advisories/527")  
npmjs.com/advisories/527
- [Reference](http://www.securityfocus.com/bid/104427 "http://www.securityfocus.com/bid/104427")  
securityfocus.com/bid/104427