File Descriptor Leak Can Cause DoS Vulnerability in hapi

MEDIUM 5.0CVE-2014-3742 · GHSA-cqr7-78pj-3g7j · Published 16/05/2014 · updated 17/06/2026

In short

CVE-2014-3742 is a MEDIUM (CVSS 5.0) vulnerability affecting hapi server framework (spumko project), hapi.
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 83.9% of all vulnerabilities.
Fix: update to 2.2.0 or later.

Package	Affected versions	Patched versions
hapi server framework spumko_project	`= 2.0.0= 2.1.1= 2.1.2`	No fix yet
hapi npm	`≥ 2.0.0, < 2.2.0`	`2.2.0`

Description

Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.

When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.

Recommendation

Please upgrade to version 2.2.x or above as soon as possible.

NVD description

The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2014-3742 · ADVISORY
spumko/hapi · WEB
GitHub Advisory GHSA-cqr7-78pj-3g7j · ADVISORY
spumko/hapi · PACKAGE
npmjs.com/advisories/11 · WEB
openwall.com/lists/oss-security/2014/05/13/1 · WEB
openwall.com/lists/oss-security/2014/05/15/2 · WEB
nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free