CVE-2017-16117

slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.

• CWE-400
• CWE-400

• https://github.com/dodo/node-slug/issues/82Third Party Advisory
• https://nodesecurity.io/advisories/537Third Party Advisory
• https://github.com/dodo/node-slug/issues/82Third Party Advisory
• https://nodesecurity.io/advisories/537Third Party Advisory

Published

Jun 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16111The content module is a module to parse HTTP Content-* heade…
• CVE-2017-16112Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-16113The parsejson module is vulnerable to regular expression den…
• CVE-2017-16114The marked module is vulnerable to a regular expression deni…
• CVE-2017-16115The timespan module is vulnerable to regular expression deni…7.5
• CVE-2017-16116The string module is a module that provides extra string ope…7.5
• CVE-2017-16118The forwarded module is used by the Express.js framework to …
• CVE-2017-16119Fresh is a module used by the Express.js framework for HTTP …
• CVE-2017-1612IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace m…
• CVE-2017-16120liyujing is a static file server. liyujing is vulnerable to …
• CVE-2017-16121datachannel-client is a signaling implementation for DataCha…
• CVE-2017-16122cuciuci is a simple fileserver. cuciuci is vulnerable to a d…