CVE-2017-16114

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jun 7, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-161157.5The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the evCVE-2017-161167.5The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of serviceCVE-2017-161177.5slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially cCVE-2017-161187.5The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression deniCVE-2017-161197.5Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of sCVE-2017-16127.8IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: CVE-2017-161207.5liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placCVE-2017-161217.5datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, givingCVE-2017-161227.5cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placingCVE-2017-161237.5welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plCVE-2017-161247.5node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker aCVE-2017-161257.5rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vul
CVE-2017-16114: High severity, CVSS 7.5 | Vulnix