CVE-2015-9242: Denial of Service in ecstatic
Summary
CVE-2015-9242: Denial of Service in ecstatic. Affects ecstatic versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ecstatic package is an npm package used for serving static files in Node.js applications. It provides a simple and efficient way to serve static content such as HTML, CSS, JavaScript, and images. However, versions prior to 1.4.0 are vulnerable to a denial of service attack when certain input strings are sent via the Last-Modified or If-Modified-Since headers.
Vulnerability Detail
The vulnerability in ecstatic arises from the way it handles certain inputs in the Last-Modified or If-Modified-Since headers. When parsing these inputs with new Date() or Date.parse(), it triggers a crash in the v8 engine. As a result, an attacker can send specially crafted input via these headers to cause the server to crash, leading to a denial of service.
How To Fix
Latest published version: 4.1.4 as of 22 Oct 2026
npm install ecstatic@4.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
npm install ecstatic@1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The ecstatic package prior to version 1.4.0 is vulnerable to a denial of service attack. To mitigate this vulnerability, it is crucial to update to version 1.4.0 or later. For further assistance or support in vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for ecstatic →
FAQ
The vulnerability allows an attacker to crash the server, leading to a denial of service. This can disrupt the availability of the application and potentially impact its users.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and it will analyze and alert you if the vulnerability is present.
No, only versions prior to 1.4.0 are affected. It is recommended to update to the latest version to ensure the vulnerability is patched.
There is no known exploit publicly available for this vulnerability at the moment. However, it is still important to update to the fixed version to prevent any potential attacks.
There are alternative packages available for serving static files in Node.js applications, such as express.static or koa-static. It is recommended to evaluate these alternatives based on your specific requirements and consider their security track record.
References
Related vulnerabilities
Recent vulnerabilities recorded for ecstatic.
