Fluid Attacks Database

Description

mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Recommendation

Update to version 2.0.3 or later.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	node-mime	>=0 <2.3.1-1	2.3.1-1
debian 12	node-mime	>=0 <2.3.1-1	2.3.1-1
npm	mime	>=2.0.0 <2.0.3 \|\| >=0 <1.4.1	2.0.3, 1.4.1
debian 14	node-mime	>=0 <2.3.1-1	2.3.1-1
debian 13	node-mime	>=0 <2.3.1-1	2.3.1-1

Aliases

1. CVE-2017-161382. NVD-2017-161383. OSV-DEBIAN-2017-161384. OSV-2017-161385. GCVE-2017-161386. SECURITY-TRACKER-CVE-2017-16138

References

1. https://github.com/broofa/node-mime/issues/1672. https://github.com/broofa/mime/commit/1df903fdeb9ae7eaa048795b8d580ce2c98f40b03. https://github.com/broofa/mime/commit/855d0c4b8b22e4a80b9401a81f2872058eae274d

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.