Skip to content
OpenAdvisories

Package · npm

debug

3 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.8
    CVE-2025-59144

    debug@4.4.2 contains malware after npm account takeover

    debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added atte…

    debug-js debug debug npm
  • Low 3.5
    CVE-2017-20165 Public exploit

    debug-js debug node.js useColors redos

    A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version …

    debug-js debug debug node-debug Debian Ubuntu npm
  • Low 3.7
    CVE-2017-16137

    Regular Expression Denial of Service in debug

    The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

    HackerOne debug node module debug node-debug Debian Ubuntu npm