What’s Vulnerable › Vulnerabilities
CVE-2017-16129
- Severity: medium (CVSS 5.9 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-06-07 · updated 2026-06-17
- Weakness: CWE-409
Description
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Affected products
- HackerOne superagent node module: before 3.7.0 — fixed in 3.7.0
How to fix
Upgrade to a fixed version: HackerOne superagent node module 3.7.0. Check the vendor advisory for mitigations.
References
- https://github.com/visionmedia/superagent/issues/1259
- https://nodesecurity.io/advisories/479
- https://github.com/visionmedia/superagent/issues/1259
- https://nodesecurity.io/advisories/479
Get alerted when CVE-2017-16129 or the next vulnerability affects your stack