CVE-2017-16023 Regular Expression Denial of Service in decamelize
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm decamelize(npm) | >= 1.1.0, <= 1.1.1 | No fix listed |
| decamelize project decamelize | = 1.1.0 | No fix listed |
| decamelize project decamelize | = 1.1.1 | No fix listed |
| HackerOne decamelize node module | = >=1.1.0 <=1.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory
- Debian Security Tracker CVE-2017-16023 vendor-advisory