CVE-2017-16098 Regular Expression Denial of Service in charset
HighCVSS 7.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm charset(npm) | < 1.0.1 | 1.0.1 |
| charset project charset | < 1.0.1 | 1.0.1 |
| HackerOne charset node module | = <1.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com exploit third-party-advisory
- github.com patch
- github.com patch
- github.com
- nodesecurity.io third-party-advisory