Denial of Service in hapi
Summary
GHSA-7hx8-2rxv-66xv: Denial of Service in hapi. Affects hapi versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hapi package is a deprecated version of the @hapi/hapi package. It is a rich framework for building applications and services in Node.js. The package provides a robust set of features for handling HTTP requests, including support for routing, authentication, and input validation. However, all versions of hapi are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in hapi is related to the Cross-Origin Resource Sharing (CORS) request handler. If the header of a CORS request contains certain invalid values, the function responsible for handling the request will throw a system error. If there is no unhandled exception handler available, the application will exit, allowing an attacker to shut down services. This vulnerability can be exploited to disrupt the availability of a hapi-based application.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the dependencies of your application to use the @hapi/hapi package instead of the deprecated hapi package. The @hapi/hapi package is actively maintained and includes security patches and bug fixes. Updating to the latest version of @hapi/hapi will mitigate the DoS vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, updating to the latest version of @hapi/hapi is the recommended solution.
Conclusion
The hapi package is vulnerable to a Denial of Service (DoS) attack due to a flaw in the handling of CORS requests. To mitigate this vulnerability, it is crucial to update the application's dependencies to use the @hapi/hapi package. This will ensure that the application is using the actively maintained version with security patches and bug fixes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hapi →
FAQ
hapi is a rich framework for building applications and services in Node.js. It provides a robust set of features for handling HTTP requests, including routing, authentication, and input validation.
The vulnerability in hapi is a Denial of Service (DoS) vulnerability related to the CORS request handler. It allows an attacker to shut down services by exploiting the handling of invalid values in the header of a CORS request.
To fix this vulnerability, update your application's dependencies to use the @hapi/hapi package instead of the deprecated hapi package. The @hapi/hapi package is actively maintained and includes security patches and bug fixes.
There is no specific workaround mentioned for this vulnerability. Updating to the latest version of @hapi/hapi is the recommended solution.
Yes, this vulnerability can be exploited remotely by sending a specially crafted CORS request with invalid header values.
References
Related vulnerabilities
Recent vulnerabilities recorded for hapi.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.