high7.5
CVE-2017-16136
method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header
Impact
Affected versions of `method-override` are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the `X-HTTP-Method-Override` header. ## Recommendation Update to version 2.3.10 or later
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | method-override | = 1.0.2 | 2.3.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Expressjs | Method-Override | before 2.3.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://nodesecurity.io/advisories/538
- https://github.com/advisories/GHSA-qx2f-477c-35rq
- https://nvd.nist.gov/vuln/detail/CVE-2017-16136
- https://www.npmjs.com/advisories/538
- https://github.com/expressjs/method-override/commit/4c58835a61fdf7a8e070d6f8ecd5379a961d0987