Executive brief
http-live-simulator is a Node.js package used to simulate HTTP Live Streaming servers for testing. Versions prior to 1.0.8 crash when receiving a specially crafted HTTP request due to an unhandled exception, causing the entire server process to shut down and disrupting streaming service availability.
Technical details
The vulnerability is an unhandled exception in http-live-simulator prior to version 1.0.8 that causes a denial of service. When an attacker sends a specific HTTP request to the server, the package fails to catch an exception, causing the Node.js process to crash and the server to shut down. This is a network-accessible denial of service attack that requires no authentication or user interaction. The fix is available in version 1.0.8 and later.
Affected products
- http-live-simulator http-live-simulator prior to 1.0.8
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Version 1.0.8 released with fix