method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

Description

Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header.

Recommendation

Update the method-override package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.0, < 2.3.10

  = 1.0.2**

• Patched version(s): 2.3.10

References

• GHSA-qx2f-477c-35rq
• www.npmjs.com
• CVE-2017-16136
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• ReDoS via long UserAgent header in useragent - CVE-2017-16030
• ReDoS in Sec-Websocket-Protocol header - CVE-2021-32640
• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
• jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method - CVE-2022-31147

Tags:

npm

method-override