Debug Project Debug vulnerabilities

CVE-2025-59144 [HIGH] CWE-506 [email protected] contains malware after npm account takeover [email protected] contains malware after npm account takeover ### Impact On 8 September 2025, the npm publishing account for `debug` was taken over after a phishing attack. Version `4.4.2` was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local envi

CVE-2017-20165 [HIGH] CWE-1333 CVE-2017-20165: A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4

CVE-2017-16137 [MEDIUM] CWE-400 CVE-2017-16137: The debug module is vulnerable to regular expression denial of service when untrusted user input is The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.