CVE-2017-16118: The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header.

Security readout for executives and security teams

CVE-2017-16118 is a denial-of-service issue in the Node.js forwarded module, used by Express.js to parse X-Forwarded-For headers. A specially crafted header can consume excessive processing and block the Node event loop, making the application unavailable. Likely exposure is Node.js web applications that depend on forwarded module versions below 0.1.2, including applications using Express.js behavior that parses X-Forwarded-For headers. Internet-facing services are more exposed because the header is commonly request-controlled. Treat this as a moderate availability risk. It is most important for public-facing Node.js or Express.js services where downtime affects customers or operations. There is no supplied evidence of active exploitation, but dependency remediation is straightforward to prioritize. Mitigation focus: Inventory applications using the forwarded package and identify versions below 0.1.2.; Upgrade forwarded to a non-affected version when vendor guidance confirms compatibility.; Review Express.js dependency trees for transitive inclusion of vulnerable forwarded versions..

Prepared

Jun 7, 2026, 13:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.