CVE-2016-10539CWE-400

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa

published May 31, 2018

CVSS
—
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01389 · 71.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2018-05-31T20:00Z
EPSS history
Timeline
  • 31 MAY 20:00Z
    negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa
    cvelistv5