CVE-2017-16129

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

Score

CVSS 3.0 5.9 Medium

Status

Modified - support@hackerone.com

Published

2018-06-07

Last modified

2024-09-16

Weaknesses

CWE-400, CWE-409

Affected products

• Superagent Node Module (Hackerone)
• Superagent (Superagent Project)

References

• https://github.com/visionmedia/superagent/issues/1259
• https://nodesecurity.io/advisories/479