GHSA-7mc5-chhp-fmc3High

Regular Expression Denial of Service in negotiator

Published
October 9, 2018
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-10539 →

📋 Description

Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value.

Recommendation

Update to version 0.6.1 or later.

🎯 Affected products1

  • npm/negotiator:< 0.6.1

🔗 References (3)