QwikSec

Security Database

CVE

CWE

Training

CVE-2017-16098

Published: Jun 7, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.

Vendor	Product	Versions
HackerOne	charset node module	affected `<1.0.0`

Weaknesses (CWE)

References

https://nodesecurity.io/advisories/524

x_refsource_MISC

https://github.com/node-modules/charset/issues/10

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.