# CVE-2015-9242: ecstatic denial of service via HTTP headers

Source: https://junglewise.ai/threats/cve-2015-9242-ecstatic-denial-of-service-via-http-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-06-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2015-9242 · Severity: info · Published 2018-06-07

ecstatic is a Node.js library that serves static files over HTTP. A vulnerability in HTTP header parsing causes the server to crash when certain malformed date strings are sent in the Last-Modified or If-Modified-Since headers, resulting in service unavailability. An attacker can exploit this with a single HTTP request, causing the application to become unresponsive.

Technologies: [ecstatic (npm)](https://junglewise.ai/threats/technologies/ecstatic). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-9242 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-9242 being exploited in the wild.

**How severe is CVE-2015-9242?** Informational severity, published 7 June 2018.

**Which products and versions are affected?** ecstatic (npm) before 1.4.0.

**Is there a fix for CVE-2015-9242?** A patch was published on 2015-12-22: Fix merged in PR #179 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-9242 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-9242?** Check whether you run ecstatic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial of service triggered by improper handling of date parsing. The vulnerable code passes the Last-Modified or If-Modified-Since HTTP header values directly to JavaScript's Date.parse() and Date constructor without validation. Certain edge-case date strings (e.g., '275760-09-24') trigger a V8 bug that raises an uncaught "illegal access" exception rather than returning an Invalid Date object, crashing the process. The attack requires only network access and no authentication; an attacker sends a crafted HTTP header to any ecstatic instance. The fix, released in version 1.4.0, wraps the date parsing in a try-catch block to handle these exceptions gracefully.

## Affected products

- npm ecstatic before 1.4.0

## Identifiers

- CVE-2015-9242
- GHSA-vwjc-q9px-r9vq

## Timeline

- 2018-06-07: disclosed
- 2015-12-22: patched: Fix merged in PR #179

## References

- [https://github.com/jfhbrook/node-ecstatic/pull/179](https://github.com/jfhbrook/node-ecstatic/pull/179)

## Related threats

- [ecstatic denial of service via URL parameter parsing](https://junglewise.ai/threats/cve-2019-10775-ecstatic-denial-of-service-via-url-parameter-parsing)
- [ecstatic open redirect vulnerability](https://junglewise.ai/threats/ecstatic-open-redirect-vulnerability-4eae3a4a)
- [ecstatic open redirect vulnerability](https://junglewise.ai/threats/ecstatic-open-redirect-vulnerability-498cb2d3)
- [ecstatic denial of service via null byte payload](https://junglewise.ai/threats/cve-2016-10703-ecstatic-denial-of-service-via-null-byte-payload)