CVE-2016-10539

2018-04-2600:00:00

CWE-400

hackerone

www.cve.org

0.001 Low

EPSS

Percentile

44.7%

JSON

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for “Accept-Language”, when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

CNA Affected

[
  {
    "product": "negotiator node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<= 0.6.0"
      }
    ]
  }
]

References

nodesecurity.io/advisories/106

0.001 Low

EPSS

Percentile

44.7%

JSON

Related for CVELIST:CVE-2016-10539