CVE-2017-16115 | BDVDB-2026-101856 Detail

HackerOnetimespan node module

Description#

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-400 Uncontrolled Resource Consumption

References#

https://github.com/indexzero/TimeSpan.js/issues/10
https://nodesecurity.io/advisories/533

Exploit#

No public exploit known

History#

Version 12018-06-07Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.