{"id":"CVE-2016-1000022","aliases":["EUVD-2016-1030","GHSA-27g3-m3gg-vg7x","RHSA-2016:1605","UBUNTU-CVE-2016-1000022"],"status":"rejected","title":"negotiator before 0.6.1 is vulnerable to a regular expression DoS","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-12-20T12:54:20Z","modified":"2026-06-29T10:13:17Z","fixes":[{"ecosystem":"Ubuntu:18.04:LTS","package":"node-negotiator","fixed_in":["0.6.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-accepts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.3-4.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-mime-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-mime-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.2-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-negotiator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-accepts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.3-4.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-mime-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-mime-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.2-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-negotiator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-negotiator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.8-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-negotiator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1"}]}],"versions":["0.4.8-1"]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000022","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1605","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000022"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-1000022"},{"url":"https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000022.json"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1000022"},{"url":"https://www.npmjs.com/advisories/106"},{"url":"https://github.com/advisories/GHSA-27g3-m3gg-vg7x"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1347677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1348509","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1605.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1000022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1000022","tags":["advisory","report"]},{"url":"https://nodesecurity.io/advisories/106","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1000023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1000023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000023","tags":["advisory"]},{"url":"https://nodesecurity.io/advisories/118","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2016-1000022","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1000022","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2019-12-20T12:54:20Z","modified":"2020-01-15T20:37:33Z","updated_at":"2026-11-02T14:33:36.802481Z"}],"euvd":[{"id":"EUVD-2016-1030","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2019-12-20T12:54:20Z","modified":"2020-01-15T20:37:33Z","updated_at":"2026-11-03T03:51:25.352035Z"}],"ghsa":[{"id":"GHSA-27g3-m3gg-vg7x","title":"negotiator before 0.6.1 is vulnerable to a regular expression DoS","description":"negotiator before 0.6.1 is vulnerable to a regular expression DoS","status":"published","published":"2022-05-24T17:04:48Z","modified":"2023-01-29T05:00:54Z","updated_at":"2026-11-02T14:44:41.662162Z"}],"nvd":[{"id":"CVE-2016-1000022","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2019-12-20T13:15:11.627Z","modified":"2023-11-07T02:29:25.667Z","updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"RHSA-2016:1605","title":"Red Hat Security Advisory: Red Hat OpenShift Enterprise security update","status":"published","published":"2024-09-15T23:33:49Z","modified":"2026-06-29T10:13:17Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-1000022","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2019-12-20T13:15:00Z","modified":"2025-10-24T04:46:01Z","updated_at":"2026-11-02T15:54:11.100633Z"}]}}