CVE-2017-16113

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-20

Affected software

VendorProductVersions
HackerOneparsejson node module<=0.0.3

References

Timeline

Published
Jun 7, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-161147.5The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characCVE-2017-161157.5The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the evCVE-2017-161167.5The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of serviceCVE-2017-161177.5slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially cCVE-2017-161187.5The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression deniCVE-2017-161197.5Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of sCVE-2017-16127.8IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: CVE-2017-161207.5liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placCVE-2017-161217.5datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, givingCVE-2017-161227.5cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placingCVE-2017-161237.5welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plCVE-2017-161247.5node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker a
CVE-2017-16113: High severity, CVSS 7.5 | Vulnix