What’s Vulnerable › Vulnerabilities

CVE-2017-16098

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-07 · updated 2026-06-17
• Weakness: CWE-400

Description

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.

Affected products

• HackerOne charset node module: before 1.0.1 — fixed in 1.0.1

How to fix

Upgrade to a fixed version: HackerOne charset node module 1.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/node-modules/charset/issues/10
• https://nodesecurity.io/advisories/524
• https://github.com/node-modules/charset/issues/10
• https://nodesecurity.io/advisories/524

Get alerted when CVE-2017-16098 or the next vulnerability affects your stack