CVE-2015-9241: hapi denial of service in date header parsing

CVE-2015-9241 · Severity: info · Published 2018-06-07

hapi is a popular web application framework for Node.js used to build HTTP servers and APIs. A malformed date value in certain HTTP headers (If-Modified-Since or Last-Modified) can cause the framework to hang the socket connection indefinitely instead of returning an error, effectively blocking that connection and potentially exhausting server resources through denial of service.

Technologies: hapi (npm). Vendors: npm.

Quick answers

Is CVE-2015-9241 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2015-9241 being exploited in the wild.
How severe is CVE-2015-9241?
Informational severity, published 7 June 2018.
Which products and versions are affected?
hapi (npm) SEMVER:introduced=0,fixed=11.1.3.
Is there a fix for CVE-2015-9241?
Yes. hapi (npm): upgrade to 11.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-9241 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2015-9241?
Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • hapi (npm): upgrade to 11.1.3 or later
    npm install hapi@11.1.3

Technical details

The vulnerability exists in hapi's date parsing logic for HTTP caching headers (If-Modified-Since and Last-Modified). When certain edge-case date values are passed to JavaScript's Date constructor—inherited from a V8 bug where specific dates raise "illegal access" exceptions instead of returning an Invalid Date object—an unhandled exception is thrown. Rather than properly handling the error and returning an HTTP 500 response, hapi leaves the socket open, which remains held until the Node.js default timeout (approximately 2 minutes) is reached. An attacker can trigger this by sending crafted date values in the header (e.g., "275760-09-24"). The fix involves wrapping date parsing in a try-catch block. The vulnerability affects hapi versions prior to 11.1.3.

Affected products

  • hapi hapi prior to 11.1.3

Identifiers

  • CVE-2015-9241
  • GHSA-rc8h-3fv6-pxv8

Timeline

  • 2018-06-07: disclosed: Published in GitHub Advisory Database
  • 2015-12-22: patched: Fix committed to hapi (v11.1.3+)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.