# CVE-2014-3742: hapi file descriptor leak denial of service

Source: https://junglewise.ai/threats/cve-2014-3742-hapi-file-descriptor-leak-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-10-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2014-3742 · Severity: info · Published 2017-10-24

hapi is a widely-used web framework for Node.js applications. Versions 2.0.x and 2.1.x contain a file descriptor leak that allows an attacker to repeatedly trigger the leak, eventually exhausting the server's available file descriptors and causing the Node.js process to crash. This results in denial of service and unavailability of the application.

Technologies: [hapi (npm)](https://junglewise.ai/threats/technologies/hapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2014-3742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2014-3742 being exploited in the wild.

**How severe is CVE-2014-3742?** Informational severity, published 24 October 2017.

**Which products and versions are affected?** hapi (npm) SEMVER:introduced=2.0.0,fixed=2.2.0.

**Is there a fix for CVE-2014-3742?** Yes. hapi (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2014-3742 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2014-3742?** Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hapi (npm): upgrade to 2.2.0 or later

  ```sh
  npm install hapi@2.2.0
  ```


## Technical details

The vulnerability is a resource exhaustion issue (CWE-400) in hapi versions 2.0.x and 2.1.x where improper file descriptor management leads to a leak. An attacker can trigger this leak repeatedly via network requests to exhaust the process file descriptor limit, causing the server to become unresponsive and eventually terminate. The vulnerability requires only network access with no authentication. The fix is available in version 2.2.0 and later.

## Affected products

- hapi hapi 2.0.x, 2.1.x

## Identifiers

- CVE-2014-3742
- GHSA-cqr7-78pj-3g7j

## Timeline

- 2014-05: disclosed: Vulnerability disclosed to oss-security mailing list
- 2014: patched: Fixed in hapi version 2.2.0
- 2017-10-24: advisory: GHSA advisory published

## References

- [https://github.com/spumko/hapi/issues/1427](https://github.com/spumko/hapi/issues/1427)

## Related threats

- [hapi Denial of Service in CORS request handler](https://junglewise.ai/threats/hapi-denial-of-service-in-cors-request-handler-015ee3b1)
- [hapi CORS configuration merge vulnerability](https://junglewise.ai/threats/cve-2015-9243-hapi-cors-configuration-merge-vulnerability)
- [hapijs hapi Rosetta-Flash JSONP vulnerability](https://junglewise.ai/threats/cve-2014-4671-hapijs-hapi-rosetta-flash-jsonp-vulnerability)
- [hapi denial of service via malformed accept-encoding header](https://junglewise.ai/threats/cve-2017-16013-hapi-denial-of-service-via-malformed-accept-encoding-header)
- [hapi CORS preflight request header handling bypass](https://junglewise.ai/threats/cve-2015-9236-hapi-cors-preflight-request-header-handling-bypass)