Denial of Service in @hapi/hapi
Summary
GHSA-23vw-mhv5-grv5: Denial of Service in @hapi/hapi. Affects @hapi/hapi across 2 version ranges.
< 18.4.1
>= 19.0.0, < 19.1.1
Fixed in 18.4.1 or 19.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hapi/hapi package is a popular Node.js framework for building web applications. It provides a robust set of features and utilities to simplify the development process. However, versions prior to 18.4.1 or 19.1.1 are vulnerable to a Denial of Service (DoS) attack. This vulnerability specifically affects the CORS request handler, which is responsible for handling Cross-Origin Resource Sharing requests. If the header of a request contains certain invalid values, the function in charge of processing the request will throw a system error. In the absence of an unhandled exception handler, the application will terminate, allowing an attacker to disrupt the services provided by the application.
Vulnerability Detail
The vulnerability in @hapi/hapi allows an attacker to trigger a DoS attack by sending requests with specific invalid values in the header. When the CORS request handler encounters these invalid values, it throws a system error, causing the application to exit. This can lead to a complete shutdown of the affected services, rendering them unavailable to legitimate users. The impact of this vulnerability can range from temporary service disruptions to prolonged downtime, depending on the availability of an unhandled exception handler. It is important to note that this vulnerability only affects versions prior to 18.4.1 or 19.1.1 of the @hapi/hapi package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 18.4.118.4.1npm install @hapi/hapi@18.4.1 -
>= 19.0.0, < 19.1.119.1.1npm install @hapi/hapi@19.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. The only effective solution is to upgrade to a patched version of the @hapi/hapi package.
Conclusion
The Denial of Service vulnerability in @hapi/hapi can have serious consequences for applications utilizing affected versions of the package. By sending requests with specific invalid header values, an attacker can cause the application to crash or exit unexpectedly, resulting in service disruptions or downtime. To mitigate this risk, it is crucial to upgrade to version 18.4.1, 19.1.1, or any later release of the @hapi/hapi package. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for @hapi/hapi →
FAQ
@hapi/hapi is a Node.js framework for building web applications. It provides a range of features and utilities to simplify the development process.
A Denial of Service attack is a malicious attempt to disrupt the normal functioning of a system or network. It aims to make a service or resource unavailable to legitimate users by overwhelming it with a flood of illegitimate requests or by exploiting vulnerabilities in the system.
If your application uses an affected version of the @hapi/hapi package, it is vulnerable to a DoS attack. An attacker can send requests with specific invalid header values, causing the application to throw a system error and exit. This can result in a complete shutdown of the affected services, rendering them unavailable to legitimate users.
No, only versions prior to 18.4.1 or 19.1.1 of the @hapi/hapi package are vulnerable to this issue. It is recommended to upgrade to a patched version to mitigate the risk.
No, there is no known workaround for this vulnerability. The only effective solution is to upgrade to a patched version of the @hapi/hapi package.
