---
title: "GHSA-7mc5-chhp-fmc3: Regular Expression Denial of Service in negotiator"
description: "High severity. Regular Expression Denial of Service in negotiator. Affects negotiator; fixed in 0.6.1."
url: https://inlinr.com/advisories/GHSA-7mc5-chhp-fmc3
lang: en
---

[Packages](https://inlinr.com/packages) / [negotiator](https://inlinr.com/packages/negotiator) / [Security](https://inlinr.com/packages/negotiator/security)

High Vulnerability GHSA-7mc5-chhp-fmc3 CVE-2016-10539 Published 9 Oct 2018

# Regular Expression Denial of Service in negotiator

Your version 

Affected releases · [negotiator](https://inlinr.com/packages/negotiator)

- 0.6.x 0.6.0 Fixed in 0.6.1
- 0.5.x and older 0.1.0 – 0.5.3 No fix, no longer updated

On 0.6.x, the newest line:

```
npm install negotiator@0.6.1
```

Every release on a timeline

1.x 

1. Not affected

1.0.0 – 1.1.0  
2 releases, latest

0.x 

1. Affected

0.1.0 – 0.6.0  
23 releases
2. Fixed

0.6.1 – 0.6.4  
4 releases

29 stable releases of negotiator, oldest to newest, one row per major.

## What happens

Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.

Recommendation

Update to version 0.6.1 or later.

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-10539 "https://nvd.nist.gov/vuln/detail/CVE-2016-10539")  
nvd.nist.gov/vuln/detail/CVE-2016-10539
- [GitHub advisory](https://github.com/advisories/GHSA-7mc5-chhp-fmc3 "https://github.com/advisories/GHSA-7mc5-chhp-fmc3")  
github.com/advisories/GHSA-7mc5-chhp-fmc3
- [Reference](https://www.npmjs.com/advisories/106 "https://www.npmjs.com/advisories/106")  
npmjs.com/advisories/106