---
id: CVE-2017-16137
title: >-
  The debug module is vulnerable to regular expression denial of service when
  untrusted user input is passed into the o formatter
summary: >-
  The debug module is vulnerable to regular expression denial of service when
  untrusted user input is passed into the o formatter. It takes around 50k
  characters to block for 2 seconds making this a low severity issue.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
vendor: debug_project
product: debug
affected:
  - 'debug >= 2.0.0, < 2.6.9'
  - 'debug >= 3.0.0, < 3.1.0'
patched:
  - debug 3.1.0
published: '2018-06-07'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:17:27.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-16137'
references:
  - url: 'https://github.com/visionmedia/debug/issues/501'
    label: support@hackerone.com
  - url: 'https://github.com/visionmedia/debug/pull/504'
    label: support@hackerone.com
  - url: >-
      https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
    label: support@hackerone.com
  - url: >-
      https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E
    label: support@hackerone.com
  - url: 'https://nodesecurity.io/advisories/534'
    label: support@hackerone.com
  - url: 'https://github.com/visionmedia/debug/issues/501'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/visionmedia/debug/pull/504'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://nodesecurity.io/advisories/534'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T15:53:36.675265Z'
epss: 0.02832
epssPercentile: 0.86558
ingestedAt: '2026-10-15T16:13:10.853Z'
---

## Overview

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

## Affected

- `debug >= 2.0.0, < 2.6.9`
- `debug >= 3.0.0, < 3.1.0`

## Remediation

Upgrade past the affected range:

- `debug 3.1.0`