CVE-2017-16136: expressjs method-override Uncontrolled Resource Consumption
Vulnerability summary
CVE-2017-16136 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in expressjs method-override. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.6% of scored vulnerabilities.
Timeline
- 07-06-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
-0.02 pp
From 1.21% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Expressjs1 product
- method-override< 2.3.10
Hackerone1 product
- method-override node module≤ 1.0.2 || > 2.0.0 < 2.3.10
Npm1 product
- method-override≥ 1.0.2, < 2.3.10 | ≥ 2.0.0, < 2.3.10
3 vendors · 3 products
