CVE-2017-16136: method-override Regular Expression Denial of Service
Summary
CVE-2017-16136: method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header. Affects method-override across 2 version ranges.
>= 1.0.2, < 2.3.10
>= 2.0.0, < 2.3.10
Fixed in 2.3.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The method-override package is an npm package that allows developers to override the HTTP method of a request. It is commonly used in web applications to simulate HTTP methods such as PUT or DELETE, which are not supported by HTML forms. The package provides middleware that intercepts requests and modifies the HTTP method based on the value of the X-HTTP-Method-Override header. This vulnerability affects versions of method-override prior to 2.3.10.
Vulnerability Detail
The vulnerability in method-override is a regular expression denial of service (ReDoS) vulnerability. It occurs when untrusted user input is passed into the X-HTTP-Method-Override header. The vulnerable regular expression pattern used to parse the header can be exploited by an attacker to cause a denial of service by providing a specially crafted input that triggers exponential backtracking. This can lead to the application becoming unresponsive or consuming excessive CPU resources. The impact of this vulnerability depends on the specific implementation of the affected application.
How To Fix
Latest published version: 3.0.0 as of 22 Oct 2026
npm install method-override@3.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.10
This is the first release that contains the fix.
npm install method-override@2.3.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the method-override package is not immediately possible, a temporary workaround is to validate and sanitize the user input before passing it to the X-HTTP-Method-Override header. This can be done by implementing input validation and filtering mechanisms to ensure that only valid and safe input is accepted. For example, developers can use a whitelist approach to only allow specific HTTP methods to be overridden.
Conclusion
The method-override package is vulnerable to a regular expression denial of service (ReDoS) vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header. To mitigate this vulnerability, it is recommended to update the package to version 2.3.10 or later. If immediate update is not possible, developers should implement input validation and filtering mechanisms to sanitize the user input. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for method-override →
FAQ
The impact of this vulnerability depends on the specific implementation of the affected application. In some cases, it can lead to the application becoming unresponsive or consuming excessive CPU resources, resulting in a denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your application and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. It is recommended to update the method-override package to version 2.3.10 or later to mitigate the risk of exploitation.
Yes, if updating the method-override package is not immediately possible, a temporary workaround is to validate and sanitize the user input before passing it to the X-HTTP-Method-Override header. This can help mitigate the risk of exploitation.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub Security Advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-qx2f-477c-35rq/GHSA-qx2f-477c-35rq.json
