Denial of Service in @hapi/ammo
Summary
GHSA-gjph-xf5q-6mfq: Denial of Service in @hapi/ammo. Affects @hapi/ammo across 2 version ranges.
< 3.1.2
>= 4.0.0, < 5.0.1
Fixed in 3.1.2 or 5.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hapi/ammo package is an HTTP utility library for the hapi framework. It provides various functions and methods to handle HTTP requests and responses. However, versions prior to 3.1.2 or 5.0.1 are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in @hapi/ammo lies in the Range HTTP header parser. If the header is set to an invalid value, the parser function throws a system error. Since hapi is not designed to handle such exceptions, the error propagates up the stack. If there is no unhandled exception handler, the application may crash, allowing an attacker to disrupt services. This vulnerability has a high severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.23.1.2npm install @hapi/ammo@3.1.2 -
>= 4.0.0, < 5.0.15.0.1npm install @hapi/ammo@5.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed versions is the only solution.
Conclusion
The @hapi/ammo package is vulnerable to a Denial of Service attack due to a flaw in the Range HTTP header parser. Upgrading to version 3.1.2 or 5.0.1 is recommended to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @hapi/ammo →
FAQ
@hapi/ammo is an HTTP utility library for the hapi framework, providing functions and methods to handle HTTP requests and responses.
A Denial of Service attack is an attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of illegitimate requests or excessive resource consumption.
The vulnerability in @hapi/ammo can lead to a DoS attack, causing the application to crash and potentially disrupting services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities.
You can find more information about this vulnerability, including its technical details and the fixed versions, in the advisory on GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-gjph-xf5q-6mfq/GHSA-gjph-xf5q-6mfq.json
