CVE-2017-16021
Medium
Description
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.
SeverityMedium
CVSS6.5
Exploit probability71. percentile1.3%
ProductGarycourt Uri-js
PublishedJun 4, 2018
First seenJun 4, 2018
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- uri-js3.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| garycourt uri-js | v ≤ 2.1.1 | — |
| uri-jsnpm | v < 3.0.0 | 3.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.