CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2017-16115
High (7.5) in timespan project timespan. EPSS 1.5% chance of exploitation in the next 30 days.
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- timespan_project:timespan
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f523-2f5j-gfcg | npm | timespan | <=2.3.0 | no fix published |