Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value.

Recommendation

Update to version 0.6.1 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10539
• GHSA-7mc5-chhp-fmc3
• https://www.npmjs.com/advisories/106