onyx --cves cve-2017-16136

CVE-2017-16136

score: <0.1
cvss: 7.5
epss: 1.2%
published: 2018-06-07
kev added: —
first seen: 2026-10-21

method-override module used by Express.js contains a regular expression denial of service caused by specially crafted input in the X-HTTP-Method-Override header, letting attackers cause denial of service, exploit requires sending crafted header.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2018-06-07 Published
by 2026-10-21 Tracked by Onyx
by 2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-400

References 1

https://nodesecurity.io/advisories/538