CVE-2016-10539: Input Validation
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-10539?
CVE-2016-10539 is a vulnerability in negotiator, an HTTP content negotiator for Node.js.
How does CVE-2016-10539 affect Node.js?
CVE-2016-10539 affects Node.js by exploiting a vulnerability in negotiator 0.6.0 and earlier.
What is the severity of CVE-2016-10539?
The severity of CVE-2016-10539 is high with a CVSS score of 7.5.
How can I fix CVE-2016-10539?
To fix CVE-2016-10539, you should update negotiator to a version higher than 0.6.0.
Where can I find more information about CVE-2016-10539?
You can find more information about CVE-2016-10539 at the following link: [https://nodesecurity.io/advisories/106](https://nodesecurity.io/advisories/106)