TI-2016-08581 Aliases CVE-2016-10539 GHSA-7mc5-chhp-fmc3

Uncontrolled resource consumption in HackerOne negotiator node module

LOW 36CWE-400Published 2018-05-31 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

Why it matters now

EPSS 0.01389 72nd percentileScored 2026-11-07

Fix Fixed negotiator (npm): 0.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HackerOne	negotiator node module	up to 0.6.0	—	No fix listed	CNA
—	negotiator (npm)	before 0.6.1	0.6.1	Patch available	GHSA-7mc5-chhp-fmc3

negotiator node module VendorHackerOne Affected up to 0.6.0 Fixed in — No fix listed CNA
negotiator (npm) Vendor— Affected before 0.6.1 Fixed in 0.6.1 Patch available GHSA-7mc5-chhp-fmc3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:negotiator_project:negotiator::::::node.js::*	up to 0.6.0	Vulnerable	Negotiator Project

cpe:2.3:a:negotiator_project:negotiator:*:*:*:*:*:node.js:*:* Versions up to 0.6.0 Vulnerable ·Negotiator Project

Remediation

Fix · GHSA-7mc5-chhp-fmc3 negotiator (npm) Fixed in 0.6.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2016-10539
2026-10-03 Alias added: GHSA-7mc5-chhp-fmc3

References

Advisory 3

Other 1

https://www.npmjs.com/advisories/106

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences