Denial of Service in @commercial/hapi
Summary
GHSA-66mv-xh68-h6v2: Denial of Service in @commercial/hapi. Affects @commercial/hapi across 4 version ranges.
< 16.8.2
>= 17.0.0, < 17.9.2
>= 18.0.0, < 18.4.1
>= 19.0.0, < 19.1.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @commercial/hapi package is an npm package used for building HTTP servers. It provides a framework for creating server applications with features such as routing, request handling, and response management. This package is widely used in various Node.js applications.
Vulnerability Detail
The vulnerability in @commercial/hapi is related to the CORS (Cross-Origin Resource Sharing) request handler. When processing a request, if the header contains certain invalid values, the function responsible for handling CORS requests may throw a system error. If there is no unhandled exception handler available, the application will exit, leading to a denial of service (DoS) condition. This vulnerability can be exploited by an attacker to shut down services and disrupt the availability of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 16.8.216.8.2npm install @commercial/hapi@16.8.2 -
>= 17.0.0, < 17.9.217.9.2npm install @commercial/hapi@17.9.2 -
>= 18.0.0, < 18.4.118.4.1npm install @commercial/hapi@18.4.1 -
>= 19.0.0, < 19.1.119.1.1npm install @commercial/hapi@19.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of the package.
Conclusion
The @commercial/hapi package is vulnerable to a denial of service (DoS) attack due to a flaw in the CORS request handler. Upgrading to the recommended fixed versions will mitigate this vulnerability. For further assistance or support in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @commercial/hapi →
FAQ
@commercial/hapi is an npm package used for building HTTP servers in Node.js applications. It provides a framework for handling requests, routing, and managing responses.
A CORS request handler is responsible for managing Cross-Origin Resource Sharing in server applications. It handles requests from different origins and determines whether to allow or deny access to requested resources based on the configured CORS policies.
A denial of service vulnerability refers to a security flaw that allows an attacker to disrupt the availability of a service or application. In this case, the vulnerability in @commercial/hapi can be exploited to cause the application to exit, resulting in a DoS condition.
An attacker can exploit this vulnerability by sending requests with specific invalid values in the header to the application using @commercial/hapi. If the application does not have an unhandled exception handler, it will exit, leading to a denial of service.
To fix this vulnerability, you should upgrade to versions 16.8.2, 17.9.2, 18.4.1, 19.1.1, or any later versions of @commercial/hapi. These versions contain the necessary patches to address the DoS vulnerability in the CORS request handler.
