GHSA-qx2f-477c-35rqHighCVSS 7.5

method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

Published
July 24, 2018
Last Modified
September 11, 2023

🔗 CVE IDs covered (1)

CVE-2017-16136 →

📋 Description

Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header.

Recommendation

Update to version 2.3.10 or later

🎯 Affected products2

  • npm/method-override:= 1.0.2
  • npm/method-override:>= 2.0.0, < 2.3.10

🔗 References (4)