CVE-2017-16117

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
HackerOne	slug node module	All versions

References

https://github.com/dodo/node-slug/issues/82Third Party Advisory
https://nodesecurity.io/advisories/537Third Party Advisory
https://github.com/dodo/node-slug/issues/82Third Party Advisory
https://nodesecurity.io/advisories/537Third Party Advisory

Timeline

Published: Jun 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-161187.5The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression deni CVE-2017-161197.5Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of s CVE-2017-16127.8IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: CVE-2017-161207.5liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plac CVE-2017-161217.5datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving CVE-2017-161227.5cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing CVE-2017-161237.5welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl CVE-2017-161247.5node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker a CVE-2017-161257.5rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vul CVE-2017-161265.3The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and tra CVE-2017-161279.8The module pandora-doomsday infects other modules. It's since been unpublished from the registry.CVE-2017-161289.8The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.