CVE-2017-16138 — nodejs-mime: Regular expression Denial of Service

Back Back to CVE browser

HIGH

nodejs-mime: Regular expression Denial of Service

Published Jun 7, 2018

7.5

HIGH

CVSS 3.0

EPSS 2.15%

Description

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Affected products

Vendor HackerOne Product Mime Node Module Default
n/a
- Version
  < 1.4.1 || > 2.0.0 < 2.0.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HackerOne

Mime Node Module

n/a

Version	Status	Constraints
< 1.4.1 \|\| > 2.0.0 < 2.0.3	affected	-

Red Hat Quay 3

quay/quay-rhel8:v3.6.0-62

Fixed · RHSA-2021:3917
Red Hat Mobile Application Platform 4

rhmap-fh-appstore-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap-fh-mbaas-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap-fh-messaging-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap-fh-metrics-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap-fh-ngui-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap-fh-scm-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap-fh-statsd-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap-fh-supercore-docker

Not affected
Red Hat Mobile Application Platform 4

rhmap45/fh-aaa

Not affected
Red Hat OpenShift Enterprise 3

nodejs-mime

Will not fix
Red Hat Software Collections

rh-nodejs4-nodejs-mime

Will not fix
Red Hat Virtualization 4

ovirt-engine-api-explorer

Not affected
Red Hat Virtualization 4

ovirt-engine-dashboard

Out of support scope
Red Hat Virtualization 4

ovirt-engine-ui-extensions

Not affected

Product	Package	State	Advisory
Red Hat Quay 3	quay/quay-rhel8:v3.6.0-62	Fixed	RHSA-2021:3917
Red Hat Mobile Application Platform 4	rhmap-fh-appstore-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap-fh-mbaas-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap-fh-messaging-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap-fh-metrics-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap-fh-ngui-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap-fh-scm-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap-fh-statsd-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap-fh-supercore-docker	Not affected	n/a
Red Hat Mobile Application Platform 4	rhmap45/fh-aaa	Not affected	n/a
Red Hat OpenShift Enterprise 3	nodejs-mime	Will not fix	n/a
Red Hat Software Collections	rh-nodejs4-nodejs-mime	Will not fix	n/a
Red Hat Virtualization 4	ovirt-engine-api-explorer	Not affected	n/a
Red Hat Virtualization 4	ovirt-engine-dashboard	Out of support scope	n/a
Red Hat Virtualization 4	ovirt-engine-ui-extensions	Not affected	n/a

Ecosystem	Package	Introduced	Fixed
npm	mime	2.0.0	2.0.3
npm	mime	0	1.4.1

Remediation

Red Hat statement

Red Hat Virtualization 4.2 EUS contained a vulnerable version of nodejs-mime in the ovirt-engine-dashboard package. This package has been removed in Red Hat Virtualization 4.2. Red Hat Quay includes mime as a dependency of Karma. It's only used at build time, not runtime so this vulnerability has a low impact of Red Hat Quay.

Metrics

2.15% 0.02153

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02153

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.15% (0.02153)	81.48th	v5 (v2026.06.15)
Jun 15, 2026	2.05% (0.02051)	78.68th	v5 (v2026.06.15)
Mar 17, 2025	0.43% (0.00433)	60.60th	v4 (v2025.03.14)
Dec 12, 2024	0.13% (0.00129)	49.30th	v3 (v2023.03.01)
Mar 5, 2024	0.13% (0.00129)	46.69th	v3 (v2023.03.01)
Jul 8, 2023	0.12% (0.00117)	44.61th	v3 (v2023.03.01)
May 8, 2023	0.10% (0.00101)	40.15th	v3 (v2023.03.01)
Mar 7, 2023	0.12% (0.00117)	43.87th	v3 (v2023.03.01)
Mar 6, 2023	4.50% (0.04499)	88.81th	v2 (v2022.01.01)
Apr 1, 2022	4.50% (0.04499)	87.70th	v2 (v2022.01.01)
Feb 4, 2022	4.50% (0.04499)	74.08th	v2 (v2022.01.01)
Feb 3, 2022	3.40% (0.03396)	67.40th	v1
Jan 6, 2022	3.40% (0.03396)	67.08th	v1
Sep 1, 2021	3.40% (0.03396)	81.71th	v1
Apr 14, 2021	3.40% (0.03396)	0.00th	v1

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

References (9)

https://access.redhat.com/security/cve/CVE-2017-16138
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1500700
Issue Tracking
https://github.com/advisories/GHSA-wrvr-8mpx-r7pp
Advisory
https://github.com/broofa/mime/commit/1df903fdeb9ae7eaa048795b8d580ce2c98f40b0
https://github.com/broofa/mime/commit/855d0c4b8b22e4a80b9401a81f2872058eae274d
https://github.com/broofa/node-mime/issues/167
x_refsource_MISCExploitThird Party Advisory
https://nodesecurity.io/advisories/535
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-16138
https://www.cve.org/CVERecord?id=CVE-2017-16138

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2017-16138		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1500700		Issue Tracking
https://github.com/advisories/GHSA-wrvr-8mpx-r7pp		Advisory
https://github.com/broofa/mime/commit/1df903fdeb9ae7eaa048795b8d580ce2c98f40b0
https://github.com/broofa/mime/commit/855d0c4b8b22e4a80b9401a81f2872058eae274d
https://github.com/broofa/node-mime/issues/167		x_refsource_MISCExploitThird Party Advisory
https://nodesecurity.io/advisories/535		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-16138
https://www.cve.org/CVERecord?id=CVE-2017-16138