|
Vulnerabilities
< Back

CVE-2017-16119

Updated on 07 Jun 2018

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Details

Affected product:
Acorn , Express , Fastify , Next.js , connect , cookie , fresh , glob , jasmine-npm , light-my-request , minimatch , protractor , send , serve-favicon , serve-static
Affected packages:
send @ 0.15.2 (+31 more)
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Fixes