Executive brief
A vulnerability in a core component of the hapi web framework could allow an attacker to crash a web server by sending a specially crafted web request. This component is responsible for processing how data is encoded during transmission. If exploited, this could lead to a complete service outage, disrupting business operations and customer access.
Technical details
The @hapi/content library, used for parsing HTTP Content-Type and Content-Encoding headers, contains a flaw in its header parsing logic. When processing a Content-Encoding header with certain invalid values, the parser throws a system error rather than a catchable application error. Because the hapi framework rethrows system errors up the stack, an unhandled exception occurs, leading to process termination. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP request, resulting in a Denial of Service (DoS). The issue is resolved in versions 4.1.1, 5.0.1, and 5.0.2.
Affected products
- hapi @hapi/content < 4.1.1, < 5.0.1
Timeline
- 2020-08-31: other: GitHub reviewed the advisory
- 2020-09-03: disclosed: Advisory published