CVE-2017-16030

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
HackerOne	useragent node module	<=2.1.12

References

https://nodesecurity.io/advisories/312Exploit, Third Party Advisory
https://nodesecurity.io/advisories/312Exploit, Third Party Advisory

Timeline

Published: Jun 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160317.5Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Ma CVE-2017-160358.1The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from ap CVE-2017-160367.5`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, gi CVE-2017-160377.5`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in th CVE-2017-160387.5`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" CVE-2017-160397.5`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl CVE-2017-16045.4IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2017-160408.1gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM atta CVE-2017-160415.9ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.CVE-2017-160429.8Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing fo CVE-2017-160436.1Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will r CVE-2017-160447.5`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.