Denial Of Service (DoS)

2019-01-1509:12:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

JSON

nodejs-negotiator is vulnerable to denial of service. An attacker able to make an application using Negotiator to perform matching using a malicious glob pattern could cause the application to consume an excessive amount of CPU.

CPENameOperatorVersion
nodejs-expresseq4.13.3__3.el7aos
nodejs-mime-dbeq1.19.0__1.el7aos
nodejs-minimatcheq3.0.0__2.el7aos
nodejs-negotiatoreq0.5.3__1.el7aos
nodejs-mime-typeseq2.1.7__1.el7aos
nodejs-acceptseq1.2.13__1.el7aos

Name	Operator	Version
nodejs-express	eq	4.13.3__3.el7aos
nodejs-mime-db	eq	1.19.0__1.el7aos
nodejs-minimatch	eq	3.0.0__2.el7aos
nodejs-negotiator	eq	0.5.3__1.el7aos
nodejs-mime-types	eq	2.1.7__1.el7aos
nodejs-accepts	eq	1.2.13__1.el7aos