GitHub Advisoryadvisory · npm

GHSA-7mc5-chhp-fmc3 Regular Expression Denial of Service in negotiator

HIGH Published 2018-10-09 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10539
Ecosystem
npm
Packages
negotiator
Severity
High
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm negotiator: < 0.6.1 → fixed in 0.6.1

Description

Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value. Recommendation Update to version 0.6.1 or later.

Related

Alias · CVE (1)

  • CVE-2016-10539 negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References