How severe is CVE-2017-20165?

CVE-2017-20165 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2017-20165 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-20165?

CVE-2017-20165 affects Debug Project Debug. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-20165?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-20165 published?

CVE-2017-20165 was published on 2023-01-09 and last updated on 2026-06-17.

CVE-2017-20165

CVE-2017-20165 is a low-severity vulnerability in Debug Project Debug with a CVSS 3.x base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1333.

Key facts

Severity: Low (CVSS 3.x base score 3.5)
CVSS v2: 2.7
EPSS exploit prediction: 2% (79th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1333
Affected product: Debug Project Debug
Published: 2023-01-09
Last modified: 2026-06-17

Description

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Frequently asked questions

What is CVE-2017-20165?: A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
How severe is CVE-2017-20165?: CVE-2017-20165 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2017-20165 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-20165?: CVE-2017-20165 affects Debug Project Debug. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-20165?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-20165 published?: CVE-2017-20165 was published on 2023-01-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:debug_project:debug:*:*:*:*:*:node.js:*:*

More vulnerabilities in Debug Project Debug

CVE-2017-16137 — Medium (CVSS 5.3): The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o…

All CVEs affecting Debug Project Debug →

Other CWE-1333 vulnerabilities

CVE-2026-35458 — Critical (CVSS 9.8): Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile…
CVE-2023-29486 — Critical (CVSS 9.8): An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass…
CVE-2026-25547 — Critical (CVSS 9.2): @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1,…
CVE-2023-29487 — Critical (CVSS 9.1): An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS,…
CVE-2026-47138 — High (CVSS 8.7): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…
CVE-2025-6998 — High (CVSS 8.7): ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated…

Browse all CWE-1333 vulnerabilities →