Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2017-20162

CVE-2017-20162MEDIUM

vercel ms index.js parse redos

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  L    5.3   .0102   62.7     —

AFFECTED
  Product  Versions  Fixed
  ms       1.x –     —

TIMELINE
  Jan 5   Reserved by VulDB
  Jan 5   Published (CNA: VulDB)
  Oct 15  RESCORED — CVE-2017-20162 (vercel ms). CVSS 4.3 → 5.3 (NVD).

CWE-1333 · CNA: VulDB · CVSS v3.1 · 6 references · NVD status: Modified

Description

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 5, 2023	Reserved	Reserved by VulDB
January 5, 2023	Published	Published (CNA: VulDB)
October 15, 2026	RESCORED	RESCORED — CVE-2017-20162 (vercel ms). CVSS 4.3 → 5.3 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
vercel	ms	—	1.x	—

Weaknesses

CWE-1333

References (6)

https://github.com/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662 [Patch]
https://github.com/vercel/ms/pull/89 [Exploit, Issue Tracking, Patch]
https://github.com/vercel/ms/releases/tag/2.0.0 [Patch, Release Notes]
https://security.netapp.com/advisory/ntap-20241108-0002/
https://vuldb.com/?ctiid.217451 [Permissions Required, Third Party Advisory]
https://vuldb.com/?id.217451 [Permissions Required, Third Party Advisory]

Authoritative record: CVE-2017-20162 at cve.org

Vendors: vercel

Weaknesses: CWE-1333

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2017-20162 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.