method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

2018-07-2420:06:04

Google

osv.dev

0.001 Low

EPSS

Percentile

44.9%

JSON

Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header.

Recommendation

Update to version 2.3.10 or later

CPENameOperatorVersion
method-overridege2.0.0
method-overridelt2.3.10
method-overrideeq1.0.2

Name	Operator	Version
method-override	ge	2.0.0
method-override	lt	2.3.10
method-override	eq	1.0.2

References

github.com/expressjs/method-override

github.com/expressjs/method-override/commit/4c58835a61fdf7a8e070d6f8ecd5379a961d0987

nvd.nist.gov/vuln/detail/CVE-2017-16136

www.npmjs.com/advisories/538

0.001 Low

EPSS

Percentile

44.9%

JSON

Related for OSV:GHSA-QX2F-477C-35RQ