debug vulnerabilities
CVEs whose affected-version data names the debug package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2025-59144High· 8.8debug is a JavaScript debugging utility
debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malw…
▾ Twilightdebug-js · debugEPSS 0.48%via NVD
CVE-2017-16137Medium· 5.3The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
▾ Sunlitdebug_project · debugEPSS 2.8%via NVD