{"id":"CVE-2017-16138","aliases":["CLSA-2026-1774398061","CLSA-2026-1781484843","CLSA-2026-1781484844","CLSA-2026-1784682759","CLSA-2026-1784769496","CLSA-2026-1792767387","DEBIAN-CVE-2017-16138","EUVD-2018-0335","GHSA-wrvr-8mpx-r7pp","ROOT-APP-NPM-CVE-2017-16138","UBUNTU-CVE-2017-16138"],"status":"published","title":"mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input","description":"The mime module \u003c 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02119,"percentile":0.81992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-06-07T02:00:00Z","modified":"2026-10-23T19:15:11Z","fixes":[{"ecosystem":"npm","package":"mime","fixed_in":["1.4.1","2.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"mime","fixed_in":["1.3.0-tuxcare.1","1.2.11-tuxcare.1","1.3.4-tuxcare.1","1.2.6-tuxcare.1","1.3.6-tuxcare.1","1.2.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-mime","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-mime","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-mime","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/mime","fixed_in":["1.3.4-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"mime","fixed_in":["1.3.4-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-tuxcare.0"},{"fixed":"1.3.0-tuxcare.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.11-tuxcare.0"},{"fixed":"1.2.11-tuxcare.1"}]}],"versions":["1.2.11"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.4-tuxcare.0"},{"fixed":"1.3.4-tuxcare.1"}]}],"versions":["1.3.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.6-tuxcare.0"},{"fixed":"1.2.6-tuxcare.1"}]}],"versions":["1.2.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.6-tuxcare.0"},{"fixed":"1.3.6-tuxcare.1"}]}],"versions":["1.3.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-tuxcare.0"},{"fixed":"1.2.4-tuxcare.1"}]}],"versions":["1.2.4"]},{"source":"osv","ecosystem":"Debian:12","package":"node-mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"npm","package":"mime","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"mime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"node-mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-1","1.2.11-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-mime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-1"]}],"products":[{"vendor":"hackerone","product":"mime node module"},{"vendor":"mime_project","product":"mime"}],"references":[{"url":"https://github.com/broofa/node-mime/issues/167","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://nodesecurity.io/advisories/535","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16138","tags":["advisory"]},{"url":"https://github.com/broofa/mime/commit/1df903fdeb9ae7eaa048795b8d580ce2c98f40b0","tags":["web"]},{"url":"https://github.com/broofa/mime/commit/855d0c4b8b22e4a80b9401a81f2872058eae274d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wrvr-8mpx-r7pp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16138","tags":["advisory"]},{"url":"https://github.com/broofa/mime","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2017-16138","tags":["report"]},{"url":"https://github.com/broofa/node-mime/commit/855d0c4b8b22e4a80b9401a81f2872058eae274d","tags":["report"]},{"url":"https://github.com/broofa/node-mime/commit/1df903fdeb9ae7eaa048795b8d580ce2c98f40b0","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16138","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-16138","description":"The mime module \u003c 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2026-10-07T20:13:00.297Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2018-0335","description":"The mime module \u003c 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2026-10-07T20:13:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:33.904651Z"}],"ghsa":[{"id":"GHSA-wrvr-8mpx-r7pp","title":"mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input","description":"Affected versions of `mime` are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.\n\n\n## Recommendation\n\nUpdate to version 2.0.3 or later.","status":"published","published":"2018-07-20T16:20:52Z","modified":"2023-09-12T18:28:55Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:04.447845Z"}],"nvd":[{"id":"CVE-2017-16138","description":"The mime module \u003c 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","status":"published","published":"2018-06-07T02:29:03.863Z","modified":"2026-10-07T21:17:01.333Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-16138","description":"The mime module \u003c 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","status":"published","published":"2018-06-07T02:29:03.863Z","modified":"2026-10-20T10:48:16.343744271Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16138","description":"The mime module \u003c 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","status":"published","published":"2018-06-07T02:29:03.863Z","modified":"2026-10-08T09:47:29.828717458Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"GHSA-wrvr-8mpx-r7pp","title":"mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input","description":"Affected versions of `mime` are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.\n\n\n## Recommendation\n\nUpdate to version 2.0.3 or later.","status":"published","published":"2018-07-20T16:20:52Z","modified":"2023-11-08T03:59:07.10265Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"UBUNTU-CVE-2017-16138","description":"The mime module \u003c 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","status":"published","published":"2018-06-07T02:29:00Z","modified":"2026-10-08T19:46:17.497885912Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"CLSA-2026-1774398061","title":"TuxCare security update for mime (1 CVE)","description":"TuxCare rebuilt mime to address 1 CVE. Fixed in 1.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:03.63113831Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1781484843","title":"TuxCare security update for mime (1 CVE)","description":"TuxCare rebuilt mime to address 1 CVE. Fixed in 1.2.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.101522456Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781484844","title":"TuxCare security update for mime (1 CVE)","description":"TuxCare rebuilt mime to address 1 CVE. Fixed in 1.3.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.32555552Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1784682759","title":"TuxCare security update for mime (1 CVE)","description":"TuxCare rebuilt mime to address 1 CVE. Fixed in 1.2.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:46Z","modified":"2026-10-15T09:47:54.190858928Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769496","title":"TuxCare security update for mime (1 CVE)","description":"TuxCare rebuilt mime to address 1 CVE. Fixed in 1.3.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.57102028Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792767387","title":"TuxCare security update for mime (1 CVE)","description":"TuxCare rebuilt mime to address 1 CVE. Fixed in 1.2.4-tuxcare.1.","status":"published","published":"2026-10-23T14:56:27Z","modified":"2026-10-23T19:15:11.342772343Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"ROOT-APP-NPM-CVE-2017-16138","title":"CVE-2017-16138 in @rootio/mime - Patched by Root","description":"Root has patched CVE-2017-16138 in the @rootio/mime package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-10T05:47:05Z","modified":"2026-07-10T07:00:05.985193298Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}