GitHub Advisoryadvisory · npm

GHSA-rc8h-3fv6-pxv8 Denial of Service in hapi

HIGH Published 2018-06-07 Modified 2020-08-31 Official page ↗
Aliases
CVE-2015-9241
Ecosystem
npm
Packages
hapi
Severity
High
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm hapi: < 11.1.3 → fixed in 11.1.3

Description

Versions of `hapi` prior to 11.1.3 are affected by a denial of service vulnerability. The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers. This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes). Recommendation Update to v11.1.3 or later

Related

Alias · CVE (1)

  • CVE-2015-9241 Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References