VYPR
← All advisories
High severityNVD Advisory· Published Jan 9, 2023· Updated Aug 5, 2024

debug-js debug node.js useColors redos

CVE-2017-20165

Description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
debugnpm
>= 3.0.0, < 3.1.03.1.0
debugnpm
< 2.6.92.6.9

Affected products

1

Patches

2
f53962e944a8

remove ReDoS regexp in %o formatter (#504)

https://github.com/debug-js/debugYa ZhuangSep 21, 2017via ghsa
commit
1 file changed · +3 −1
  • src/node.js+3 −1 modified
    @@ -85,7 +85,9 @@ function useColors() {
 exports.formatters.o = function(v) {
   this.inspectOpts.colors = this.useColors;
   return util.inspect(v, this.inspectOpts)
-    .replace(/\s*\n\s*/g, ' ');
+    .split('\n').map(function(str) {
+      return str.trim()
+    }).join(' ');
 };
 
 /**
c38a0166c266

remove ReDoS regexp in %o formatter (#504)

https://github.com/debug-js/debugYa ZhuangSep 21, 2017via ghsa
commit
1 file changed · +3 −1
  • src/node.js+3 −1 modified
    @@ -83,7 +83,9 @@ function useColors() {
 exports.formatters.o = function(v) {
   this.inspectOpts.colors = this.useColors;
   return util.inspect(v, this.inspectOpts)
-    .replace(/\s*\n\s*/g, ' ');
+    .split('\n').map(function(str) {
+      return str.trim()
+    }).join(' ');
 };
 
 /**

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.