Fluid Attacks Database

Description

method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header.

Recommendation

Update to version 2.3.10 or later

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	method-override	=1.0.2 \|\| >=1.0.2 <2.3.10 \|\| >=2.0.0 <2.3.10	2.3.10, 2.3.10

Aliases

1. CVE-2017-161362. NVD-2017-161363. OSV-2017-161364. GCVE-2017-16136

References

1. https://github.com/expressjs/method-override/commit/4c58835a61fdf7a8e070d6f8ecd5379a961d09872. https://www.npmjs.com/advisories/538

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.