Denial of Service in hapi
Published 3 Sept 2020 · Updated 31 Aug 2020
Affected package
- Affected
- >=0.0.0
- Fixed in
- No fix released
Details
All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.
Recommendation
This package is deprecated and is now maintained as @hapi/hapi. Please update your dependencies to use @hapi/hapi.
Is GHSA-7hx8-2rxv-66xv in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected hapi, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.