CVE-2017-16136: High severity expressjs Method-override Node.js vulnerability
Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header.
Recommendation
Update to version 2.3.10 or later
Other sources
method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16136?
CVE-2017-16136 is classified as a regular expression denial of service vulnerability.
How do I fix CVE-2017-16136?
To fix CVE-2017-16136, update the method-override package to version 2.3.10 or later.
What versions of method-override are affected by CVE-2017-16136?
CVE-2017-16136 affects method-override versions prior to 2.3.10.
What is the impact of CVE-2017-16136?
The impact of CVE-2017-16136 can lead to denial of service if untrusted input is processed.
Is it safe to use method-override versions below 2.3.10 after the discovery of CVE-2017-16136?
No, using method-override versions below 2.3.10 is not safe due to the vulnerability identified in CVE-2017-16136.