GitHub Advisoryadvisory · npm

GHSA-qx2f-477c-35rq method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

HIGH Published 2018-07-24 Modified 2023-09-11 Official page ↗
Aliases
CVE-2017-16136
Ecosystem
npm
Packages
method-override
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm method-override: >= 1.0.2, < 2.3.10 → fixed in 2.3.10 • npm method-override: >= 2.0.0, < 2.3.10 → fixed in 2.3.10

Description

Affected versions of `method-override` are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the `X-HTTP-Method-Override` header. Recommendation Update to version 2.3.10 or later

Related

Alias · CVE (1)

  • CVE-2017-16136 method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References