Packages / negotiator / Security

HighVulnerabilityGHSA-7mc5-chhp-fmc3CVE-2016-10539Published 9 Oct 2018

Regular Expression Denial of Service in negotiator

Your version

Affected releases · negotiator

  • 0.6.x0.6.0Fixed in 0.6.1
  • 0.5.x and older0.1.0 – 0.5.3No fix, no longer updated

On 0.6.x, the newest line:

npm install negotiator@0.6.1
Every release on a timeline
1.x

  1. Not affected

    1.0.0 – 1.1.0

    2 releases, latest

0.x

  1. Affected

    0.1.0 – 0.6.0

    23 releases

  2. Fixed

    0.6.1 – 0.6.4

    4 releases

29 stable releases of negotiator, oldest to newest, one row per major.

What happens

Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value.

Recommendation

Update to version 0.6.1 or later.