CVE-2017-16119
HIGHfresh < 0.5.2 - Denial of Service via Regular Expression
Title source: llmDescription
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://nodesecurity.io/advisories/526
Scores
CVSS v3
7.5
EPSS
0.0158
EPSS Percentile
72.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (2)
fresh_project/fresh
< 0.5.2
npm/fresh
0 - 0.5.2npm
Published
Jun 07, 2018
Tracked Since
Feb 18, 2026