Uncontrolled resource consumption in HackerOne debug node module
Priority LOW 29CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02832 86th percentileScored 2026-11-07
Fix Partial debug (npm): 2.6.9, 3.1.0, 3.2.7 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HackerOne | debug node module | <= 2.6.8 || >= 3.0.0 <= 3.0.1 | — | No fix listed | CNA |
| — | debug (npm) | before 2.6.9 | 2.6.9 | Patch available | GHSA-gxpj-cx7g-858c |
| — | debug (npm) | 3.0.0 to before 3.1.0 | 3.1.0 | Patch available | GHSA-gxpj-cx7g-858c |
| — | debug (npm) | 3.2.0 to before 3.2.7 | 3.2.7 | Patch available | GHSA-gxpj-cx7g-858c |
| — | debug (npm) | 4.0.0 to before 4.3.1 | 4.3.1 | Patch available | GHSA-gxpj-cx7g-858c |
- debug node module VendorHackerOne Affected <= 2.6.8 || >= 3.0.0 <= 3.0.1 Fixed in — No fix listed CNA
- debug (npm) Vendor— Affected before 2.6.9 Fixed in 2.6.9 Patch available GHSA-gxpj-cx7g-858c
- debug (npm) Vendor— Affected 3.0.0 to before 3.1.0 Fixed in 3.1.0 Patch available GHSA-gxpj-cx7g-858c
- debug (npm) Vendor— Affected 3.2.0 to before 3.2.7 Fixed in 3.2.7 Patch available GHSA-gxpj-cx7g-858c
- debug (npm) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-gxpj-cx7g-858c
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debug_project:debug:*:*:*:*:*:node.js:*:* | 2.0.0 to before 2.6.9; 3.0.0 to before 3.1.0 | Vulnerable | Debug Project |
- cpe:2.3:a:debug_project:debug:*:*:*:*:*:node.js:*:* Versions 2.0.0 to before 2.6.9; 3.0.0 to before 3.1.0 Vulnerable ·Debug Project
Remediation
- Fix · GHSA-gxpj-cx7g-858c debug (npm) Fixed in 2.6.9 Advisory →
- Fix · GHSA-gxpj-cx7g-858c debug (npm) Fixed in 3.1.0 Advisory →
- Fix · GHSA-gxpj-cx7g-858c debug (npm) Fixed in 3.2.7 Advisory →
- Fix · GHSA-gxpj-cx7g-858c debug (npm) Fixed in 4.3.1 Advisory →
Red Hat 1 advisory
- RHSA-2021:3917 Released 2021-10-19 · Red Hat rating ImportantRed Hat Quay v3.6.0 security, bug fix and enhancement update
- Quay v3 quay/quay-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 3 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Virtualization 4 | Affected | No fix planned: Out of support scope |
| Quay v3 | Fixed | RHSA-2021:3917 |
Not affected: 3 products
- Quay v3
- Red Hat Mobile Application Platform 4
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2017-16137
- 2026-10-03 Alias added: GHSA-gxpj-cx7g-858c
- 2026-10-16 CISA SSVC decision points changed
References
Advisory 3
Other 10
- [netbeans-commits] 20200429 [jira] [Created] (NETBEANS-4280) cleanup potential security breaches
- [netbeans-notifications] 20200429 [GitHub] [netbeans] BradWalker opened a new pull request #2110: [NETBEANS-4280] - cleanup potential security breaches
- https://github.com/debug-js/debug/issues/797
- https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020
- https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290
- https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac
- https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a
- https://github.com/visionmedia/debug
- https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E
More Debug Project Debug vulnerabilities
- TI-2017-14231 debug-js debug node.js useColors redos CVSS 3.1HIGH 7.5
Sources
- CVE-2017-16137 · CVE Program
- CVE-2017-16137 · NVD
- FIRST EPSS
- GHSA-gxpj-cx7g-858c · GitHub Advisory Database · CC BY 4.0
- CVE-2017-16137 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences