GitHub Advisoryadvisory · npm

GHSA-jcpv-g9rr-qxrc Regular Expression Denial of Service in hawk

HIGH Published 2018-07-31 Modified 2021-09-14 Official page ↗
Aliases
CVE-2016-2515
Ecosystem
npm
Packages
hawk
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2020-06-16

Affected packages

• npm hawk: >= 4.0.0, < 4.1.1 → fixed in 4.1.1 • npm hawk: < 3.1.3 → fixed in 3.1.3

Description

Versions of `hawk` prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long headers and URI's. Recommendation Update to hawk version 4.1.1 or later.

Related

Alias · CVE (1)

  • CVE-2016-2515 Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References