expressjs/method-override · Security
method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header
- GHSA ID
- GHSA-qx2f-477c-35rq
- CVE ID
- CVE-2017-16136
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header.
Recommendation
Update to version 2.3.10 or later
CWEs
- CWE-400 · Uncontrolled Resource Consumption