# CVE-2017-16013: hapi denial of service via malformed accept-encoding header

Source: https://junglewise.ai/threats/cve-2017-16013-hapi-denial-of-service-via-malformed-accept-encoding-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16013 · Severity: low · CVSS 3 · Published 2018-10-09

hapi is a popular Node.js web application framework. When a malformed accept-encoding HTTP header is received, the framework crashes or enters an infinite loop, causing the web application to become unresponsive and potentially timeout across multiple client connections.

Technologies: [hapi (npm)](https://junglewise.ai/threats/technologies/hapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-16013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16013 being exploited in the wild.

**How severe is CVE-2017-16013?** Low severity, with a CVSS score of 3, published 9 October 2018.

**Which products and versions are affected?** hapi (npm) SEMVER:introduced=15.0.0,fixed=16.1.1.

**Is there a fix for CVE-2017-16013?** Yes. hapi (npm): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-16013 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-16013?** Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hapi (npm): upgrade to 16.1.1 or later

  ```sh
  npm install hapi@16.1.1
  ```


## Technical details

hapi versions 15.0.0 through 16.1.0 improperly handle malformed accept-encoding headers, resulting in a denial of service. The vulnerability exists in the compression module (lib/compression.js) where the framework fails to validate the header format before attempting to use it as an encoding type. When a non-conformant header is received, the code enters an error state and never sends a response to the client, leaving connections hanging. This is triggered via a network-accessible HTTP request and requires no authentication or user interaction. An attacker can craft and send malicious accept-encoding headers to cause the server to hang or crash, disrupting service availability. The issue was fixed in version 16.1.1.

## Affected products

- hapi hapi 15.0.0 to 16.1.0

## Identifiers

- CVE-2017-16013
- GHSA-cqjg-whmm-8gv6

## Timeline

- 2017-03-31: disclosed: Issue reported on GitHub
- 2017: patched: Fixed in version 16.1.1
- 2018-10-09: advisory: GHSA advisory published

## References

- [https://github.com/hapijs/hapi/issues/3466](https://github.com/hapijs/hapi/issues/3466)

## Related threats

- [hapi Denial of Service in CORS request handler](https://junglewise.ai/threats/hapi-denial-of-service-in-cors-request-handler-015ee3b1)
- [hapi CORS configuration merge vulnerability](https://junglewise.ai/threats/cve-2015-9243-hapi-cors-configuration-merge-vulnerability)
- [hapijs hapi Rosetta-Flash JSONP vulnerability](https://junglewise.ai/threats/cve-2014-4671-hapijs-hapi-rosetta-flash-jsonp-vulnerability)
- [hapi CORS preflight request header handling bypass](https://junglewise.ai/threats/cve-2015-9236-hapi-cors-preflight-request-header-handling-bypass)
- [hapi denial of service in date header parsing](https://junglewise.ai/threats/cve-2015-9241-hapi-denial-of-service-in-date-header-parsing)