CVE-2017-16013

hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

Score

CVSS 3.0 7.5 High

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-17

Weaknesses

CWE-20, CWE-400

Affected products

• Hapi Node Module (Hackerone)
• Hapi (Hapijs)

References

• https://github.com/hapijs/hapi/issues/3466
• https://nodesecurity.io/advisories/335