method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

Description

Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header.

Recommendation

Update the method-override package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.0, < 2.3.10

  = 1.0.2**

• Patched version(s): 2.3.10

References

• GHSA-qx2f-477c-35rq
• www.npmjs.com
• CVE-2017-16136
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• ReDoS via long UserAgent header in useragent - CVE-2017-16030
• Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - CVE-2026-42034
• Handling untrusted input can result in a crash, leading to loss of availability / denial of service - CVE-2024-30253
• Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction - CVE-2026-31828

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

method-override