|Description||Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|sid, trixie, bookworm||0.5.2+~0.5.0-2||fixed|
The information below is based on the following data on fixed versions.
[stretch] - node-fresh <end-of-life> (Nodejs in stretch not covered by security support)
[jessie] - node-fresh <end-of-life> (Nodejs in jessie not covered by security support)