# CVE-2016-10703: ecstatic denial of service via null byte payload

Source: https://junglewise.ai/threats/cve-2016-10703-ecstatic-denial-of-service-via-null-byte-payload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-12-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2016-10703 · Severity: low · CVSS 3.1 · Published 2017-12-28

ecstatic is a Node.js middleware for serving static files. An attacker can crash the server by sending HTTP requests with payloads containing large numbers of null bytes (%00), causing the server to consume memory until it crashes. This impacts availability of web applications relying on ecstatic for asset delivery.

Technologies: [ecstatic (npm)](https://junglewise.ai/threats/technologies/ecstatic). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-10703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10703 being exploited in the wild.

**How severe is CVE-2016-10703?** Low severity, with a CVSS score of 3.1, published 28 December 2017.

**Which products and versions are affected?** ecstatic (npm) <2.0.0.

**Is there a fix for CVE-2016-10703?** A patch was published on 2.0.0: Fixed by restoring null-byte filtering Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10703 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-10703?** Check whether you run ecstatic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial of service caused by improper handling of null bytes in URL paths. ecstatic previously stripped null bytes from URLs as a workaround for an old Node.js url.parse bug, but removal of this filtering exposed a regex-based denial-of-service attack vector. An unauthenticated network attacker can send crafted HTTP requests with null-byte-laden payloads to trigger excessive memory allocation and crash the server. A 86 kB payload was observed to cause immediate crash. The vulnerability affects all versions prior to 2.0.0, which restored null-byte filtering to mitigate the issue.

## Affected products

- npm ecstatic <2.0.0

## Identifiers

- CVE-2016-10703
- GHSA-pm9p-9926-w68m

## Timeline

- 2017-12-14: disclosed
- 2.0.0: patched: Fixed by restoring null-byte filtering
- 2017-12-28: advisory

## References

- [https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01](https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01)

## Related threats

- [ecstatic denial of service via URL parameter parsing](https://junglewise.ai/threats/cve-2019-10775-ecstatic-denial-of-service-via-url-parameter-parsing)
- [ecstatic open redirect vulnerability](https://junglewise.ai/threats/ecstatic-open-redirect-vulnerability-4eae3a4a)
- [ecstatic open redirect vulnerability](https://junglewise.ai/threats/ecstatic-open-redirect-vulnerability-498cb2d3)
- [ecstatic denial of service via HTTP headers](https://junglewise.ai/threats/cve-2015-9242-ecstatic-denial-of-service-via-http-headers)