CVE-2017-16119

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
HackerOne	fresh node module	< 0.5.2

References

https://nodesecurity.io/advisories/526Third Party Advisory
https://nodesecurity.io/advisories/526Third Party Advisory

Timeline

Published: Jun 7, 2018
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-16127.8IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: CVE-2017-161207.5liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plac CVE-2017-161217.5datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving CVE-2017-161227.5cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing CVE-2017-161237.5welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl CVE-2017-161247.5node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker a CVE-2017-161257.5rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vul CVE-2017-161265.3The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and tra CVE-2017-161279.8The module pandora-doomsday infects other modules. It's since been unpublished from the registry.CVE-2017-161289.8The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.CVE-2017-161295.9The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed respons CVE-2017-16135.3IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive Engagemen