CVE-2017-16136: method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header
7.5
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.55082%
CWE
Published
7/24/2018
Updated
9/11/2023
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| method-override | npm | = 1.0.2 | 2.3.10 |
| method-override | npm | >= 2.0.0, < 2.3.10 | 2.3.10 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from the header parsing logic in createHeaderGetter, which originally used a regex split on the entire header value. The commit diff shows this was replaced with a simple indexOf/trim operation to avoid regex processing. This matches the ReDoS vulnerability pattern where complex regex operations on untrusted input create denial-of-service risks. The patch specifically addresses this by eliminating the vulnerable regex split.