CVE-2017-16136: method-override ReDoS in X-HTTP-Method-Override header

CVE-2017-16136 · Severity: low · CVSS 3 · Published 2018-07-24

method-override is a Node.js middleware library that allows HTTP clients to override the request method via a custom header. A regular expression denial-of-service (ReDoS) vulnerability allows an attacker to send specially crafted HTTP requests that cause the server to hang or become unresponsive, disrupting service availability for legitimate users.

Vendors: npm.

Quick answers

Is CVE-2017-16136 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2017-16136 being exploited in the wild.
How severe is CVE-2017-16136?
Low severity, with a CVSS score of 3, published 24 July 2018.
Which products and versions are affected?
method-override (npm) SEMVER:introduced=1.0.2,fixed=2.3.10.
Is there a fix for CVE-2017-16136?
Yes. method-override (npm): upgrade to 2.3.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-16136 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2017-16136?
Check whether you run method-override (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • method-override (npm): upgrade to 2.3.10 or later
    npm install method-override@2.3.10

Technical details

method-override contains a regular expression denial-of-service (ReDoS) vulnerability in its parsing of the X-HTTP-Method-Override header. The vulnerable component uses an inefficient regular expression that exhibits catastrophic backtracking when processing untrusted input with certain patterns. An attacker can send a crafted HTTP request with a malicious X-HTTP-Method-Override header value to cause excessive CPU consumption, leading to denial of service. No authentication or user interaction is required; the vulnerability is triggered by network-accessible HTTP headers. The fix, released in version 2.3.10, optimizes the header parsing logic to skip unnecessary regex evaluation.

Affected products

  • Express.js method-override 1.0.2 through 2.3.9

Identifiers

  • CVE-2017-16136
  • GHSA-qx2f-477c-35rq

Timeline

  • 2018-07-24: disclosed
  • 2017: patched: Fix committed (version 2.3.10)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.