CVE-2017-16118

score

<0.1

cvss

7.5

epss

1.9%

published

2018-06-07

kev added

—

first seen

2026-10-21

The forwarded module used by Express.js to handle the X-Forwarded-For header contains a regular expression denial of service caused by crafted input, letting attackers block the event loop and cause denial of service, exploit requires passing malicious input.