CVE-2016-2515: Regular Expression Denial of Service in hawk
Summary
CVE-2016-2515: Regular Expression Denial of Service in hawk. Affects hawk across 2 version ranges.
< 3.1.3
>= 4.0.0, < 4.1.1
Fixed in 3.1.3 or 4.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hawk package is an npm module that provides a HTTP authentication scheme using a message authentication code (MAC) algorithm. It is commonly used in Node.js applications to secure communication between clients and servers. However, versions prior to 3.1.3 and 4.x prior to 4.1.1 are vulnerable to a regular expression denial of service (ReDoS) attack. This vulnerability arises from the handling of excessively long headers and URIs, which can cause the application to consume excessive CPU resources and become unresponsive.
Vulnerability Detail
The regular expression denial of service vulnerability in hawk allows an attacker to exploit the application's regex pattern matching algorithm by providing specially crafted input. By sending a request with excessively long headers or URIs, the application can be forced into a state where it spends an excessive amount of time attempting to match the input against the regex pattern. This can lead to a denial of service condition, where the application becomes unresponsive and fails to handle legitimate requests. The impact of this vulnerability is a potential disruption of service availability.
How To Fix
Latest published version: 9.0.2 as of 22 Oct 2026
npm install hawk@9.0.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.1.33.1.3npm install hawk@3.1.3 -
>= 4.0.0, < 4.1.14.1.1npm install hawk@4.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the hawk package is not immediately feasible, a temporary workaround can be implemented by implementing rate limiting or input validation mechanisms to restrict the length of headers and URIs. By enforcing reasonable limits on the size of these inputs, the impact of a potential ReDoS attack can be mitigated. Here is an example of how rate limiting can be implemented using the express-rate-limit middleware in a Node.js application:
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP to 100 requests per windowMs
});
app.use(limiter);
Conclusion
The regular expression denial of service vulnerability in hawk can be mitigated by updating to the latest version of the package. If immediate update is not possible, implementing rate limiting or input validation mechanisms can provide temporary protection. It is important to regularly monitor and update dependencies to ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for hawk →
FAQ
The vulnerability allows an attacker to cause a denial of service condition by sending requests with excessively long headers or URIs. This can result in the application becoming unresponsive and failing to handle legitimate requests, leading to a disruption of service availability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this one.
No, only versions prior to 3.1.3 and 4.x prior to 4.1.1 are affected. It is recommended to update to the latest version to mitigate the vulnerability.
Yes, if updating the hawk package is not immediately feasible, you can implement rate limiting or input validation mechanisms to restrict the length of headers and URIs. This can help mitigate the risk of a denial of service attack.
You can find more information about this vulnerability, including the CVE identifier, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-jcpv-g9rr-qxrc/GHSA-jcpv-g9rr-qxrc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for hawk.
