Denial of Service in @hapi/accept
Summary
GHSA-9vrw-m88g-w75q: Denial of Service in @hapi/accept. Affects @hapi/accept across 2 version ranges.
>= 3.2.0, < 3.2.4
>= 4.0.0, < 5.0.1
Fixed in 3.2.4 or 5.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hapi/accept package is a part of the hapi framework, which is a rich framework for building applications and services. It provides various features and utilities to handle HTTP requests and responses. The package @hapi/accept specifically deals with parsing the Accept-Encoding HTTP header. This header is used by clients to indicate the compression algorithms they support. However, versions prior to 3.2.4 or 5.0.1 of @hapi/accept are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in @hapi/accept lies in its Accept-Encoding HTTP header parser. If the header contains certain invalid values, the parser function throws a system error. Since hapi rethrows system errors instead of catching expected application errors, the error propagates up the stack. If there is no unhandled exception handler available, the application will exit, allowing an attacker to shut down services. This vulnerability can be exploited by sending specially crafted requests with invalid Accept-Encoding headers, causing the targeted application to crash or become unresponsive.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.2.0, < 3.2.43.2.4npm install @hapi/accept@3.2.4 -
>= 4.0.0, < 5.0.15.0.1npm install @hapi/accept@5.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of @hapi/accept to ensure the security and stability of the application.
Conclusion
The Denial of Service vulnerability in @hapi/accept can be mitigated by upgrading to version 3.2.4 or 5.0.1. It is crucial to promptly apply the fix to ensure the security and stability of the application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @hapi/accept →
FAQ
The vulnerability allows an attacker to send specially crafted requests that can cause the targeted application to crash or become unresponsive, leading to a denial of service.
No, only versions prior to 3.2.4 or 5.0.1 are vulnerable. It is recommended to upgrade to the fixed versions to mitigate the risk.
There is no known public exploit for this vulnerability at the moment. However, it is still crucial to update to the fixed versions to prevent any potential attacks.
Yes, this vulnerability can be exploited remotely by sending specially crafted requests with invalid Accept-Encoding headers.
There are alternative packages available for handling HTTP headers, such as 'accepts' and 'http-accept'. However, the suitability of these alternatives depends on the specific requirements of the application.
