# CVE-2017-16136: method-override ReDoS in X-HTTP-Method-Override header

Source: https://junglewise.ai/threats/cve-2017-16136-method-override-redos-in-x-http-method-override-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16136 · Severity: low · CVSS 3 · Published 2018-07-24

method-override is a Node.js middleware library that allows HTTP clients to override the request method via a custom header. A regular expression denial-of-service (ReDoS) vulnerability allows an attacker to send specially crafted HTTP requests that cause the server to hang or become unresponsive, disrupting service availability for legitimate users.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-16136 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16136 being exploited in the wild.

**How severe is CVE-2017-16136?** Low severity, with a CVSS score of 3, published 24 July 2018.

**Which products and versions are affected?** method-override (npm) SEMVER:introduced=1.0.2,fixed=2.3.10.

**Is there a fix for CVE-2017-16136?** Yes. method-override (npm): upgrade to 2.3.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-16136 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-16136?** Check whether you run method-override (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- method-override (npm): upgrade to 2.3.10 or later

  ```sh
  npm install method-override@2.3.10
  ```


## Technical details

method-override contains a regular expression denial-of-service (ReDoS) vulnerability in its parsing of the X-HTTP-Method-Override header. The vulnerable component uses an inefficient regular expression that exhibits catastrophic backtracking when processing untrusted input with certain patterns. An attacker can send a crafted HTTP request with a malicious X-HTTP-Method-Override header value to cause excessive CPU consumption, leading to denial of service. No authentication or user interaction is required; the vulnerability is triggered by network-accessible HTTP headers. The fix, released in version 2.3.10, optimizes the header parsing logic to skip unnecessary regex evaluation.

## Affected products

- Express.js method-override 1.0.2 through 2.3.9

## Identifiers

- CVE-2017-16136
- GHSA-qx2f-477c-35rq

## Timeline

- 2018-07-24: disclosed
- 2017: patched: Fix committed (version 2.3.10)

## References

- [https://github.com/expressjs/method-override/commit/4c58835a61fdf7a8e070d6f8ecd5379a961d0987](https://github.com/expressjs/method-override/commit/4c58835a61fdf7a8e070d6f8ecd5379a961d0987)