CVE-2017-16115

State: Published
Severity: Not scored
Published: Jun 7, 2018
Updated: Sep 17, 2024
Reserved: Oct 29, 2017

Description

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.

Scores

The record has no CVSS score.

Weaknesses

CWE-400 Denial of Service (CWE-400)

Affected Products

Product	Versions
timespan node moduleHackerOne	All versionsAffected

References

https://github.com/indexzero/TimeSpan.js/issues/10
https://nodesecurity.io/advisories/533

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.