CVE-2016-10539
Regular Expression Denial of Service in negotiator
CVE-2016-10539 is a high vulnerability (CVSS 7.5) in Negotiator Project Negotiator, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in negotiator 0.6.1.
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
- Record
CVE-2016-10539- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-20
- Updated
- 2026-11-02
CVE List No score
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
- Record
CVE-2016-10539- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0538 No score
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
- Record
EUVD-2018-0538- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mc5-chhp-fmc3 No score
Regular Expression Denial of Service in negotiator
Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value.
Recommendation
Update to version 0.6.1 or later.
- Record
GHSA-7mc5-chhp-fmc3- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVAZL-44826
CVE-2016-10539 affecting package nodejs-nodemon 2.0.3-5
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
- Record
AZL-44826- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
- Record
CVE-2016-10539- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2016-10539
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
- Record
DEBIAN-CVE-2016-10539- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10539
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
- Record
UBUNTU-CVE-2016-10539- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1774830279 No score
TuxCare security update for negotiator (1 CVE)
TuxCare rebuilt negotiator to address 1 CVE. Fixed in 0.5.3-tuxcare.1.
- Record
CLSA-2026-1774830279- Updated
- 2026-11-02
OSVCLSA-2026-1784682762 No score
TuxCare security update for negotiator (1 CVE)
TuxCare rebuilt negotiator to address 1 CVE. Fixed in 0.3.0-tuxcare.1.
- Record
CLSA-2026-1784682762- Updated
- 2026-11-02
OSVCLSA-2026-1792489812 No score
TuxCare security update for negotiator (1 CVE)
TuxCare rebuilt negotiator to address 1 CVE. Fixed in 0.4.7-tuxcare.1.
- Record
CLSA-2026-1792489812- Updated
- 2026-11-02
OSVGHSA-7mc5-chhp-fmc3 No score
Regular Expression Denial of Service in negotiator
Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value.
Recommendation
Update to version 0.6.1 or later.
- Record
GHSA-7mc5-chhp-fmc3- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2016-10539 No score
CVE-2016-10539 in negotiator - Patched by Root
Root has patched CVE-2016-10539 in the negotiator package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2016-10539- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
negotiatornpm |
before 0.6.1 | 0.6.1 |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
negotiatorTuxCare:npm |
0.5.3-tuxcare.0 up to 0.5.3-tuxcare.1, plus listed versions 0.5.3 |
0.5.3-tuxcare.1 |
negotiatorTuxCare:npm |
0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions 0.3.0 |
0.3.0-tuxcare.1 |
negotiatorTuxCare:npm |
0.4.7-tuxcare.0 up to 0.4.7-tuxcare.1, plus listed versions 0.4.7 |
0.4.7-tuxcare.1 |
node-negotiatorDebian:12 |
before 0.6.1-1 | 0.6.1-1 |
node-negotiatorDebian:13 |
before 0.6.1-1 | 0.6.1-1 |
node-negotiatorDebian:14 |
before 0.6.1-1 | 0.6.1-1 |
node-negotiatorUbuntu:16.04:LTS |
All versions, plus listed versions 0.4.8-1 |
None known |
node-negotiatorUbuntu:18.04:LTS |
before 0.6.1-1, plus listed versions 0.4.8-1 |
0.6.1-1 |
node-negotiatorUbuntu:20.04:LTS |
before 0.6.1-1 | 0.6.1-1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |