# CVE-2017-16138: mime regular expression denial of service

Source: https://junglewise.ai/threats/cve-2017-16138-mime-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16138 · Severity: low · CVSS 3 · Published 2018-07-20

The mime library is a widely-used Node.js package that identifies file types based on filenames or content. When processing untrusted user input (such as filenames), the library's pattern-matching code can be forced to consume excessive CPU resources, causing application slowdowns or crashes. An attacker can trigger this by providing specially crafted input, disrupting service availability for legitimate users.

## Quick answers

**Is CVE-2017-16138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16138 being exploited in the wild.

**How severe is CVE-2017-16138?** Low severity, with a CVSS score of 3, published 20 July 2018.

**Which products and versions are affected?** Mime SEMVER:introduced=2.0.0,fixed=2.0.3.

**Is there a fix for CVE-2017-16138?** Yes. Mime: upgrade to 2.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-16138 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-16138?** Check whether you run Mime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Mime: upgrade to 2.0.3 or later

## Technical details

This vulnerability is a regular expression denial of service (ReDoS) affecting the mime library's MIME type lookup functionality. The vulnerable regex patterns are triggered when mime attempts to match user-supplied input, such as filenames, against its type definitions. The attack requires only network-level access to a system that performs mime lookups on untrusted data and does not require authentication or user interaction. An attacker can craft malicious input strings that cause the regex engine to perform catastrophic backtracking, consuming significant CPU and degrading or denying service. The vulnerability was fixed in mime version 1.4.1 and 2.0.3 or later.

## Affected products

- mime mime 0 to 1.4.0 and 2.0.0 to 2.0.2

## Identifiers

- CVE-2017-16138
- GHSA-wrvr-8mpx-r7pp

## Timeline

- 2018-07-20: disclosed
- 2017: patched: Fixes available in mime 1.4.1 and 2.0.3+

## References

- [https://github.com/broofa/node-mime/issues/167](https://github.com/broofa/node-mime/issues/167)