Executive brief
@commercial/subtext is a Node.js library used to handle HTTP request parsing and content encoding. A flaw in the Content-Encoding header parser causes the application to crash when malformed header values are sent, allowing an attacker to shut down services without authentication or specialized access.
Technical details
The vulnerability exists in the Content-Encoding HTTP header parser in @commercial/subtext version 5.1.1, where invalid header values trigger an unhandled system error. The hapi framework rethrows system errors rather than catching application errors, causing the exception to propagate uncaught to the process level. An attacker can send a crafted HTTP request with a malformed Content-Encoding header to trigger the crash and terminate the application. The fix is available in version 5.1.2 and later.
Affected products
- @commercial subtext 5.1.1
Timeline
- 2020-09-03: disclosed