superagent vulnerable to zip bomb attacks

Also known as GHSA-8225-6cvr-8pqp

Published 8 y ago 2018-06-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.9

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.7%

percentile 78%

Public exploits

none known

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

Exploit prediction (EPSS)

1.74% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	7.1	`AV:N/AC:M/Au:N/C:N/I:N/A:C`
GitHub	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`superagent`	<3.7.0	3.7.0

Affected products

HackerOne superagent node module

Classification

Weakness

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
CWE-400 Uncontrolled Resource Consumption

References

nodesecurity.io /advisories/479 · x_refsource_MISC, x_transferred
github.com /visionmedia/superagent/issues/1259 · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-16129 · advisory
en.wikipedia.org /wiki/Zip_bomb · web
github.com /advisories/GHSA-8225-6cvr-8pqp · advisory
npmjs.com /advisories/479 · web

Sources

CVE List: CVE-2017-16129
GitHub Advisory: GHSA-8225-6cvr-8pqp
NVD: CVE-2017-16129

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary