Executive brief
A vulnerability in the hapi web framework can allow an attacker to crash a web server by sending a specially crafted request. hapi is a popular tool used by developers to build applications and services. If an attacker exploits this flaw, the application may stop responding to all users, leading to a service outage and potential business disruption.
Technical details
A Denial of Service (DoS) vulnerability exists in the CORS (Cross-Origin Resource Sharing) request handler of @hapi/hapi. The handler fails to properly catch system errors thrown when processing certain invalid values within request headers. If the application does not have a global unhandled exception handler, these errors will cause the Node.js process to terminate. An unauthenticated remote attacker can exploit this by sending a malicious HTTP request, leading to a complete service shutdown. The issue is resolved in versions 18.4.1 and 19.1.1.
Affected products
- hapi @hapi/hapi < 18.4.1, >= 19.0.0 < 19.1.1
Timeline
- 2020-08-31: patched: Fixes released in versions 18.4.1 and 19.1.1
- 2020-09-03: disclosed: Advisory published on GitHub/OSV