CVE-2016-10539
node-negotiator: negotiator is an HTTP content negotiator for Node.js and is used by manymodules and frameworks including Express and Koa
CVE-2016-10539 is fixed in node-negotiator on 1 platform, first by node-negotiator 0.6.1-1, released May 31, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0139
72nd percentile
negotiator is an HTTP content negotiator for Node.js and is used by manymodules and frameworks including Express and Koa. The header for"Accept-Language", when parsed by negotiator 0.6.0 and earlier isvulnerable to Regular Expression Denial of Service via a specially craftedstring.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| node-negotiator · Ubuntu 18.04.6 LTS (bionic) | 0.6.1-1 | node-negotiator 0.6.1-1 | Dec 20, 2019 |
| node-negotiator · Ubuntu 20.04 LTS (focal) | 0.6.1-1 | node-negotiator 0.6.1-1 | May 31, 2018 |
| node-negotiator · Ubuntu 24.10 (oracular) | 0.6.1-1 | node-negotiator 0.6.1-1 | Jan 16, 2026 |
| node-negotiator · Ubuntu 25.04 (plucky) | 0.6.1-1 | node-negotiator 0.6.1-1 | Jan 16, 2026 |