Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, with a CVSS score of 7.5, published 3 September 2020.

Which products and versions are affected?

@commercial/hapi (npm) SEMVER:introduced=0,fixed=16.8.2.

Is there a fix for This vulnerability?

Yes. @commercial/hapi (npm): upgrade to 16.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run @commercial/hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

@commercial/hapi CORS denial of service

Severity: info · CVSS 7.5 · Published 2020-09-03

@commercial/hapi is a JavaScript library for building web applications. A vulnerability in its CORS (Cross-Origin Resource Sharing) request handler allows attackers to crash the application by sending requests with malformed headers, causing an unhandled exception that terminates the service.

Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, with a CVSS score of 7.5, published 3 September 2020.
Which products and versions are affected?: @commercial/hapi (npm) SEMVER:introduced=0,fixed=16.8.2.
Is there a fix for This vulnerability?: Yes. @commercial/hapi (npm): upgrade to 16.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run @commercial/hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@commercial/hapi (npm): upgrade to 16.8.2 or later
```
npm install @commercial/hapi@16.8.2
```

Technical details

The vulnerability exists in the CORS request handler of @commercial/hapi, which fails to properly validate header values. When the handler receives requests with certain invalid header values, it throws an unhandled system error. If the application lacks a global exception handler, this causes the entire process to exit, resulting in denial of service. The vulnerability affects multiple version ranges (pre-16.8.2, 17.0.0–17.9.1, 18.0.0–18.4.0, and 19.0.0–19.1.0) and is fixed in versions 16.8.2, 17.9.2, 18.4.1, and 19.1.1 or later.

Affected products

@commercial hapi <16.8.2, 17.0.0–17.9.1, 18.0.0–18.4.0, 19.0.0–19.1.0

Timeline

2020-09-03: disclosed

References

https://www.npmjs.com/advisories/1483

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.