Every CVESearch/Get API key

CVE-2016-1000022

negotiator before 0.6.1 is vulnerable to a regular expression DoS

5.3 MediumFix availableRejected

CVE-2016-1000022 has been rejected by its source and should not be treated as a live vulnerability, published December 20, 2019. Fixed in node-negotiator 0.6.1-1.

What does this mean?
Severity
5.3 MediumCVSS 3.0, OSV
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.6.1-1node-negotiator +13 more

Description

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Affected packages

Affected packages
PackageAffectedFixed
nodejs-accepts
Red Hat:openshift:3.1::el7
From an advisory covering 2 CVEs
before 0:1.3.3-1.el7
0:1.3.3-1.el7
nodejs-express
Red Hat:openshift:3.1::el7
From an advisory covering 2 CVEs
before 0:4.13.3-4.el7
0:4.13.3-4.el7
nodejs-mime-db
Red Hat:openshift:3.1::el7
From an advisory covering 2 CVEs
before 0:1.23.0-1.el7
0:1.23.0-1.el7
nodejs-mime-types
Red Hat:openshift:3.1::el7
From an advisory covering 2 CVEs
before 0:2.1.11-1.el7
0:2.1.11-1.el7
nodejs-minimatch
Red Hat:openshift:3.1::el7
From an advisory covering 2 CVEs
before 0:3.0.2-1.el7
0:3.0.2-1.el7
nodejs-negotiator
Red Hat:openshift:3.1::el7
From an advisory covering 2 CVEs
before 0:0.6.1-1.el7
0:0.6.1-1.el7
nodejs-accepts
Red Hat:openshift:3.2::el7
From an advisory covering 2 CVEs
before 0:1.3.3-1.el7
0:1.3.3-1.el7
nodejs-express
Red Hat:openshift:3.2::el7
From an advisory covering 2 CVEs
before 0:4.13.3-4.el7
0:4.13.3-4.el7
nodejs-mime-db
Red Hat:openshift:3.2::el7
From an advisory covering 2 CVEs
before 0:1.23.0-1.el7
0:1.23.0-1.el7
nodejs-mime-types
Red Hat:openshift:3.2::el7
From an advisory covering 2 CVEs
before 0:2.1.11-1.el7
0:2.1.11-1.el7
Show 4 moreShow less
Affected packages
PackageAffectedFixed
nodejs-minimatch
Red Hat:openshift:3.2::el7
From an advisory covering 2 CVEs
before 0:3.0.2-1.el7
0:3.0.2-1.el7
nodejs-negotiator
Red Hat:openshift:3.2::el7
From an advisory covering 2 CVEs
before 0:0.6.1-1.el7
0:0.6.1-1.el7
node-negotiator
Ubuntu:16.04:LTS
All versions, plus listed versions
0.4.8-1
None known
node-negotiator
Ubuntu:18.04:LTS
before 0.6.1-1, plus listed versions
0.4.8-1
0.6.1-1

What each source reports

OSV Score usedRHSA-2016:16055.3

Red Hat Security Advisory: Red Hat OpenShift Enterprise security update

Record
RHSA-2016:1605
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
CVE ListNo score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Record
CVE-2016-1000022
Updated
2026-11-02
EUVDEUVD-2016-1030No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Record
EUVD-2016-1030
Updated
2026-11-03
GitHub AdvisoriesGHSA-27g3-m3gg-vg7xNo score

negotiator before 0.6.1 is vulnerable to a regular expression DoS

negotiator before 0.6.1 is vulnerable to a regular expression DoS

Record
GHSA-27g3-m3gg-vg7x
Updated
2026-11-02
NVDNo score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Record
CVE-2016-1000022
Updated
2026-11-02
OSVUBUNTU-CVE-2016-1000022No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Record
UBUNTU-CVE-2016-1000022
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 14 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open