Executive brief
restify-paginate is a Node.js library that adds pagination support to Restify-based web services. A missing HTTP Host header causes the library to crash with an uncaught exception, allowing remote attackers to take down the service without authentication.
Technical details
A missing or malformed HTTP Host header triggers an unhandled exception in restify-paginate version 0.0.5 and earlier versions. The vulnerability stems from improper input validation when processing pagination-related HTTP headers (CWE-755). An unauthenticated remote attacker can send a crafted HTTP request without a Host header, causing the Restify-based web service to crash. No authentication, special privileges, or user interaction is required. The impact is availability: the service becomes unavailable until manually restarted.
Affected products
- restify-paginate restify-paginate 0.0.5 and earlier
Timeline
- 2021-02-25: disclosed: NVD published
- 2021-04-12: advisory: GHSA advisory published