CVE-2017-16138
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
- Record
CVE-2017-16138- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0335
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
- Record
EUVD-2018-0335- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wrvr-8mpx-r7pp
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Recommendation
Update to version 2.0.3 or later.
- Record
GHSA-wrvr-8mpx-r7pp- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
- Record
CVE-2017-16138- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
- Record
CVE-2017-16138- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16138
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
- Record
DEBIAN-CVE-2017-16138- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-wrvr-8mpx-r7pp
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Recommendation
Update to version 2.0.3 or later.
- Record
GHSA-wrvr-8mpx-r7pp- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16138
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
- Record
UBUNTU-CVE-2017-16138- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1774398061 No score
TuxCare security update for mime (1 CVE)
TuxCare rebuilt mime to address 1 CVE. Fixed in 1.3.0-tuxcare.1.
- Record
CLSA-2026-1774398061- Updated
- 2026-11-02
OSVCLSA-2026-1781484843 No score
TuxCare security update for mime (1 CVE)
TuxCare rebuilt mime to address 1 CVE. Fixed in 1.2.11-tuxcare.1.
- Record
CLSA-2026-1781484843- Updated
- 2026-11-02
OSVCLSA-2026-1781484844 No score
TuxCare security update for mime (1 CVE)
TuxCare rebuilt mime to address 1 CVE. Fixed in 1.3.4-tuxcare.1.
- Record
CLSA-2026-1781484844- Updated
- 2026-11-02
OSVCLSA-2026-1784682759 No score
TuxCare security update for mime (1 CVE)
TuxCare rebuilt mime to address 1 CVE. Fixed in 1.2.6-tuxcare.1.
- Record
CLSA-2026-1784682759- Updated
- 2026-11-02
OSVCLSA-2026-1784769496 No score
TuxCare security update for mime (1 CVE)
TuxCare rebuilt mime to address 1 CVE. Fixed in 1.3.6-tuxcare.1.
- Record
CLSA-2026-1784769496- Updated
- 2026-11-02
OSVCLSA-2026-1792767387 No score
TuxCare security update for mime (1 CVE)
TuxCare rebuilt mime to address 1 CVE. Fixed in 1.2.4-tuxcare.1.
- Record
CLSA-2026-1792767387- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2017-16138 No score
CVE-2017-16138 in @rootio/mime - Patched by Root
Root has patched CVE-2017-16138 in the @rootio/mime package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2017-16138- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mimenpm |
before 1.4.1 | 1.4.1 |
mimenpm |
2.0.0 up to 2.0.3 | 2.0.3 |
mimeTuxCare:npm |
1.3.0-tuxcare.0 up to 1.3.0-tuxcare.1, plus listed versions 1.3.0 |
1.3.0-tuxcare.1 |
mimeTuxCare:npm |
1.2.11-tuxcare.0 up to 1.2.11-tuxcare.1, plus listed versions 1.2.11 |
1.2.11-tuxcare.1 |
mimeTuxCare:npm |
1.3.4-tuxcare.0 up to 1.3.4-tuxcare.1, plus listed versions 1.3.4 |
1.3.4-tuxcare.1 |
mimeTuxCare:npm |
1.2.6-tuxcare.0 up to 1.2.6-tuxcare.1, plus listed versions 1.2.6 |
1.2.6-tuxcare.1 |
mimeTuxCare:npm |
1.3.6-tuxcare.0 up to 1.3.6-tuxcare.1, plus listed versions 1.3.6 |
1.3.6-tuxcare.1 |
mimeTuxCare:npm |
1.2.4-tuxcare.0 up to 1.2.4-tuxcare.1, plus listed versions 1.2.4 |
1.2.4-tuxcare.1 |
node-mimeDebian:12 |
before 2.3.1-1 | 2.3.1-1 |
node-mimeDebian:13 |
before 2.3.1-1 | 2.3.1-1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-mimeDebian:14 |
before 2.3.1-1 | 2.3.1-1 |
@rootio/mimeRoot:npm |
before 1.3.4-root.io.1 | 1.3.4-root.io.1 |
mimeRoot:npm |
before 1.3.4-aikido.1 | 1.3.4-aikido.1 |
node-mimeUbuntu:14.04:LTS |
All versions, plus listed versions 1.2.5-11.2.11-1 |
None known |
node-mimeUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.4-1 |
None known |
node-mimeUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.4-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16138 is a high vulnerability (CVSS 7.5) in Mime Project Mime, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in mime 1.4.1.
References
github.com/broofa/node-mime/issues/167
nodesecurity.io/advisories/535
nvd.nist.gov/vuln/detail/CVE-2017-16138