HighGHSA-23vw-mhv5-grv5
Denial of Service in @hapi/hapi
Published 3 Sept 2020 · Updated 31 Aug 2020
Affected packages
@hapi/hapinpm
- Affected
- <18.4.1
- Fixed in
- 18.4.1
Update to the fixed version for your release line, for example:
npm install @hapi/hapi@18.4.1@hapi/hapinpm
- Affected
- >=19.0.0 <19.1.1
- Fixed in
- 19.1.1
Update to the fixed version for your release line, for example:
npm install @hapi/hapi@19.1.1Details
Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.
Recommendation
Upgrade to versions 18.4.1, 19.1.1 or later.
Is GHSA-23vw-mhv5-grv5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected @hapi/hapi, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.