HighGHSA-cqr7-78pj-3g7jCVE-2014-3742
File Descriptor Leak Can Cause DoS Vulnerability in hapi
Published 24 Oct 2017 · Updated 8 Nov 2023
Affected package
hapinpm
- Affected
- >=2.0.0 <2.2.0
- Fixed in
- 2.2.0
Update to the fixed version for your release line, for example:
npm install hapi@2.2.0Details
Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.
When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.
Recommendation
- Please upgrade to version 2.2.x or above as soon as possible.
Is GHSA-cqr7-78pj-3g7j in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected hapi, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.