GHSA-9qj9-36jm-prpv

GitHub Security Advisory

Regular Expression Denial of Service in fresh

✓ GitHub Reviewed HIGH Has CVE

Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.

## Recommendation

Update to version 0.5.2 or later.

npm fresh

Affected versions: 0 (fixed in 0.5.2)

CVE-2017-16119

GHSA ID

GHSA-9qj9-36jm-prpv

Published

July 24, 2018 8:16 PM

Last Modified

September 8, 2023 9:32 PM

CVSS Score

7.5 /10

Primary Ecosystem

npm

Primary Package

fresh

GitHub Reviewed

✓ Yes

Last updated: July 2, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.