# @commercial/subtext denial of service in payload handling

Source: https://junglewise.ai/threats/commercial-subtext-denial-of-service-in-payload-handling-accfbde9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-03

@commercial/subtext is a Node.js library for handling HTTP request payloads and file uploads. Versions before 5.1.1 fail to enforce maximum payload size limits on chunked uploads, allowing attackers to send arbitrarily large requests that exhaust disk space and system memory, causing the application to become unavailable.

Technologies: [@commercial/subtext (npm)](https://junglewise.ai/threats/technologies/commercial-subtext). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 3 September 2020.

**Which products and versions are affected?** @commercial/subtext (npm) SEMVER:introduced=0,fixed=5.1.1.

**Is there a fix for This vulnerability?** Yes. @commercial/subtext (npm): upgrade to 5.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run @commercial/subtext (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @commercial/subtext (npm): upgrade to 5.1.1 or later

  ```sh
  npm install @commercial/subtext@5.1.1
  ```


## Technical details

The vulnerability is a resource exhaustion flaw (CWE-400) in @commercial/subtext's payload handling logic. The maxBytes configuration parameter is not properly enforced for HTTP requests with chunked transfer encoding that are written to the file system, allowing an unauthenticated network attacker to send unbounded payload sizes. An attacker can exploit this by sending requests with chunked encoding to exhaust available disk space or system memory, resulting in denial of service. The vulnerability is fixed in version 5.1.1 and later.

## Affected products

- commercial @commercial/subtext before 5.1.1

## Timeline

- 2020-09-03: disclosed

## References

- [https://github.com/hapijs/subtext/issues/72](https://github.com/hapijs/subtext/issues/72)
- [https://www.npmjs.com/advisories/1166](https://www.npmjs.com/advisories/1166)

## Related threats

- [Commercial @commercial/subtext prototype pollution in multipart parsing](https://junglewise.ai/threats/commercial-commercial-subtext-prototype-pollution-in-multipart-parsing-aa7a56bc)
- [@commercial/subtext denial of service via Content-Encoding header](https://junglewise.ai/threats/commercial-subtext-denial-of-service-via-content-encoding-header-7155598d)