CVE-2017-16115

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.

Score

CVSS 3.1 7.5 High

Status

Modified - support@hackerone.com

Published

2018-06-07

Last modified

2024-09-17

Weaknesses

CWE-400

Affected products

• Timespan Node Module (Hackerone)
• Timespan (Timespan Project)

References

• https://github.com/indexzero/TimeSpan.js/issues/10
• https://nodesecurity.io/advisories/533