Executive brief
@commercial/hapi is a JavaScript library for building web applications. A vulnerability in its CORS (Cross-Origin Resource Sharing) request handler allows attackers to crash the application by sending requests with malformed headers, causing an unhandled exception that terminates the service.
Technical details
The vulnerability exists in the CORS request handler of @commercial/hapi, which fails to properly validate header values. When the handler receives requests with certain invalid header values, it throws an unhandled system error. If the application lacks a global exception handler, this causes the entire process to exit, resulting in denial of service. The vulnerability affects multiple version ranges (pre-16.8.2, 17.0.0–17.9.1, 18.0.0–18.4.0, and 19.0.0–19.1.0) and is fixed in versions 16.8.2, 17.9.2, 18.4.1, and 19.1.1 or later.
Affected products
- @commercial hapi <16.8.2, 17.0.0–17.9.1, 18.0.0–18.4.0, 19.0.0–19.1.0
Timeline
- 2020-09-03: disclosed