CVE-2017-16098

Source

https://nvd.nist.gov/vuln/detail/CVE-2017-16098

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16098.json

Aliases

• GHSA-9cp3-fh5x-xfcj

Published

2018-06-07T02:29:02Z

Modified

2023-11-29T06:09:00.553468Z

Details

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.

References

• https://nodesecurity.io/advisories/524
• https://github.com/node-modules/charset/issues/10