CVE-2017-16116

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
HackerOne	string node module	All versions

References

https://github.com/jprichardson/string.js/issues/212Exploit, Third Party Advisory
https://nodesecurity.io/advisories/536Patch, Third Party Advisory
https://github.com/jprichardson/string.js/issues/212Exploit, Third Party Advisory
https://nodesecurity.io/advisories/536Patch, Third Party Advisory

Timeline

Published: Jun 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-161177.5slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially c CVE-2017-161187.5The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression deni CVE-2017-161197.5Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of s CVE-2017-16127.8IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: CVE-2017-161207.5liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plac CVE-2017-161217.5datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving CVE-2017-161227.5cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing CVE-2017-161237.5welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl CVE-2017-161247.5node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker a CVE-2017-161257.5rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vul CVE-2017-161265.3The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and tra CVE-2017-161279.8The module pandora-doomsday infects other modules. It's since been unpublished from the registry.