jshttp/negotiator

jshttp/negotiator

GitHubGitHub
GitHubgithub.com
Releases16
Frequency8 months 3 weeks
Last Release
Stars384
An HTTP content negotiator for Node.js
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2016-10539NVD↗
<= 0.6.0—5 MEDIUM

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.