Executive brief
hapi is a popular web application framework for Node.js used to build HTTP servers and APIs. A malformed date value in certain HTTP headers (If-Modified-Since or Last-Modified) can cause the framework to hang the socket connection indefinitely instead of returning an error, effectively blocking that connection and potentially exhausting server resources through denial of service.
Technical details
The vulnerability exists in hapi's date parsing logic for HTTP caching headers (If-Modified-Since and Last-Modified). When certain edge-case date values are passed to JavaScript's Date constructor—inherited from a V8 bug where specific dates raise "illegal access" exceptions instead of returning an Invalid Date object—an unhandled exception is thrown. Rather than properly handling the error and returning an HTTP 500 response, hapi leaves the socket open, which remains held until the Node.js default timeout (approximately 2 minutes) is reached. An attacker can trigger this by sending crafted date values in the header (e.g., "275760-09-24"). The fix involves wrapping date parsing in a try-catch block. The vulnerability affects hapi versions prior to 11.1.3.
Affected products
- hapi hapi prior to 11.1.3
Timeline
- 2018-06-07: disclosed: Published in GitHub Advisory Database
- 2015-12-22: patched: Fix committed to hapi (v11.1.3+)