Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlxajktMzZqbS1wcnB2

Regular Expression Denial of Service in fresh

Affected versions of fresh are vulnerable to regular expression denial of service when parsing specially crafted user input.

Recommendation

Update to version 0.5.2 or later.

Permalink: https://github.com/advisories/GHSA-9qj9-36jm-prpv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlxajktMzZqbS1wcnB2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 6 years ago
Updated: about 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-9qj9-36jm-prpv, CVE-2017-16119
References: Blast Radius: 50.3

Affected Packages

npm:fresh
Dependent packages: 1,541
Dependent repositories: 5,019,855
Downloads: 138,386,761 last month
Affected Version Ranges: < 0.5.2
Fixed in: 0.5.2
All affected versions: 0.0.1, 0.1.0, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.3.0, 0.4.0, 0.5.0, 0.5.1
All unaffected versions: 0.5.2, 1.0.0, 2.0.0