env variable DEBUG is not parsed correctly

[zymon]

If the DEBUG env variable contains multiple items separated with spaces, then only the first one is used.

For example:
export DEBUG="APP_X APP_Y APP_Z"

Then, only the APP_X is enabled for debugging. Other apps are ignored. This is due to the way the string is parsed:

In debug\src\common.js, line 169:

const split = (typeof namespaces === 'string' ? namespaces : '') .trim() .replace(' ', ',') .split(',') .filter(Boolean);

replace('', ',') changes only the first occurrence of space

So, to fix it you can use regexp:

const split = (typeof namespaces === 'string' ? namespaces : '') .trim() .replace(/ /g, ',') .split(',') .filter(Boolean);

[jheeanny]

You identified the bug correctly. The replace(" ", ",") only replaces the first space. Changing it to replace(/\s/g, ","), or better replace(/\s+/g, ","), will split all whitespace-separated namespaces.

This is a one-line fix in src/common.js around line 169.

Suggestion: also add a unit test for multiple spaces (e.g., DEBUG="A B C" should enable all three). Could you open a PR? It is a safe, high-impact fix for many users.

[abhu85]

Good news - this bug has already been fixed!

Looking at the current src/common.js (line 171), the code now uses:

.replace(/\s+/g, ',')

instead of the original .replace(' ', ',') which only replaced the first space.

This fix is included in v4.4.3 (the latest release on npm). Users experiencing this issue should upgrade:

npm install debug@latest

I believe this issue can be closed.

[abhu85]

This issue appears to be fixed in the current codebase (v4.4.3).

Current code at src/common.js:171:

const split = (typeof namespaces === 'string' ? namespaces : '')
    .trim()
    .replace(/\s+/g, ',')  // Uses regex with global flag
    .split(',')
    .filter(Boolean);

Verification:

const debug = require('debug');
debug.enable('APP_X APP_Y APP_Z');
console.log(debug.names); // ['APP_X', 'APP_Y', 'APP_Z'] ✅

All three namespaces are correctly parsed and enabled. The fix likely came in during the security updates in September 2025.

This issue can probably be closed.