GitHub Advisoryadvisory · npm
GHSA-vwjc-q9px-r9vq Denial of Service in ecstatic
HIGH
Official page ↗
- Aliases
- CVE-2015-9242
- Ecosystem
- npm
- Packages
- ecstatic
- Severity
- High
- Weaknesses
- CWE-400
- Reviewed
- 2020-06-16
Affected packages
• npm ecstatic: < 1.4.0 → fixed in 1.4.0
Description
Versions of `ecstatic` prior to 1.4.0 are affected by a denial of service vulnerability when certain input strings are sent via the `Last-Modified` or `If-Modified-Since` headers.
Parsing certain inputs with `new Date()` or `Date.parse()` cases v8 to crash. As ecstatic passes the value of the affected headers into one of these functions, sending certain inputs via one of the headers will cause the server to crash.
Recommendation
Update to version 1.4.0 or later.
Related
Alias · CVE (1)
- CVE-2015-9242 Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-9242 advisory
- https://github.com/jfhbrook/node-ecstatic/pull/179 web
- https://github.com/jfhbrook/node-ecstatic/commit/0d0a2779ac5e5843d3745920212dfac9b69440e2 web
- https://bugs.chromium.org/p/v8/issues/detail?id=4640 web
- https://github.com/jfhbrook/node-ecstatic package