Denial of Service in @commercial/subtext
Summary
GHSA-cvfm-xjc8-f2vm: Denial of Service in @commercial/subtext. Affects @commercial/subtext versions >= 5.1.1, < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @commercial/subtext package is an npm package used for handling Content-Encoding HTTP headers. It is a part of the hapi ecosystem and is responsible for parsing the header values. The package version 5.1.1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability lies in the Content-Encoding HTTP header parser, which throws a system error if the header contains certain invalid values. As hapi rethrows system errors, the error propagates up the stack. If there is no unhandled exception handler available, the application will crash, allowing an attacker to disrupt services.
Vulnerability Detail
The vulnerability in @commercial/subtext version 5.1.1 allows an attacker to trigger a DoS attack by sending a specially crafted Content-Encoding HTTP header with invalid values. When the header is parsed, the function throws a system error, which is rethrown by hapi. If the application does not have an unhandled exception handler, it will crash, resulting in a denial of service. This vulnerability can be exploited remotely, and the impact can be severe as it can lead to service disruption and unavailability.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
npm install @commercial/subtext@5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The @commercial/subtext package version 5.1.1 is vulnerable to a DoS attack due to a flaw in the Content-Encoding HTTP header parser. To mitigate this vulnerability, it is crucial to upgrade to version 5.1.2 or later. Vulert's playground can be used to check if your application is affected. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @commercial/subtext →
FAQ
The vulnerability allows an attacker to trigger a DoS attack, causing the application to crash and resulting in service disruption and unavailability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the @commercial/subtext package.
There are no known public exploits for this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent potential attacks.
This vulnerability was discovered and reported by the GitHub Security Lab.
References
Related vulnerabilities
Recent vulnerabilities recorded for @commercial/subtext.
