Executive brief
Subtext is a software library used to process incoming data for web applications, particularly those using the hapi framework. A vulnerability exists where the library fails to limit the size of data being uploaded when using specific transfer methods. An attacker could exploit this to send massive amounts of data, filling up server storage or memory and causing the application to crash or become unavailable to legitimate users.
Technical details
A Denial of Service (DoS) vulnerability exists in the subtext HTTP payload parser due to improper resource requirement management (CWE-400). The library fails to enforce the 'maxBytes' configuration limit when processing incoming payloads using chunked transfer encoding that are configured to be written directly to the file system. A remote, unauthenticated attacker can exploit this by sending a request with an arbitrarily large payload, potentially exhausting disk space or other system resources. This package is no longer maintained; users should migrate to @hapi/subtext version 6.1.2 or later where the fix was implemented.
Affected products
- hapijs subtext All versions
Timeline
- 2019-09-13: other: Issue first reported on GitHub
- 2020-09-03: advisory: GitHub Advisory published