Executive brief
hapi is a widely-used web framework for Node.js applications. Versions 2.0.x and 2.1.x contain a file descriptor leak that allows an attacker to repeatedly trigger the leak, eventually exhausting the server's available file descriptors and causing the Node.js process to crash. This results in denial of service and unavailability of the application.
Technical details
The vulnerability is a resource exhaustion issue (CWE-400) in hapi versions 2.0.x and 2.1.x where improper file descriptor management leads to a leak. An attacker can trigger this leak repeatedly via network requests to exhaust the process file descriptor limit, causing the server to become unresponsive and eventually terminate. The vulnerability requires only network access with no authentication. The fix is available in version 2.2.0 and later.
Affected products
- hapi hapi 2.0.x, 2.1.x
Timeline
- 2014-05: disclosed: Vulnerability disclosed to oss-security mailing list
- 2014: patched: Fixed in hapi version 2.2.0
- 2017-10-24: advisory: GHSA advisory published