Denial of Service in ecstatic

HIGH 7.5CVE-2015-9242 · GHSA-vwjc-q9px-r9vq · Published 29/05/2018 · updated 17/06/2026

In short

CVE-2015-9242 is a HIGH (CVSS 7.5) vulnerability affecting ecstatic (ecstatic project), ecstatic.
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.4% of all vulnerabilities.
Fix: update to 1.4.0 or later.

Package	Affected versions	Patched versions
ecstatic ecstatic_project	`< 1.4.0`	`1.4.0`
ecstatic npm	`< 1.4.0`	`1.4.0`

Description

Versions of ecstatic prior to 1.4.0 are affected by a denial of service vulnerability when certain input strings are sent via the Last-Modified or If-Modified-Since headers.

Parsing certain inputs with new Date() or Date.parse() cases v8 to crash. As ecstatic passes the value of the affected headers into one of these functions, sending certain inputs via one of the headers will cause the server to crash.

Recommendation

Update to version 1.4.0 or later.

NVD description

Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.

References

nvd.nist.gov/vuln/detail/CVE-2015-9242 · ADVISORY
jfhbrook/node-ecstatic#179 · WEB
jfhbrook/node-ecstatic commit 0d0a277 · WEB
bugs.chromium.org/p/v8/issues/detail · WEB
jfhbrook/node-ecstatic · PACKAGE
nodesecurity.io/advisories/64 · Third Party Advisory

More vulnerabilities in ecstatic

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ecstatic

ecstatic_project

< 1.4.0

1.4.0

ecstatic

npm

< 1.4.0

1.4.0

Description

Versions of ecstatic prior to 1.4.0 are affected by a denial of service vulnerability when certain input strings are sent via the Last-Modified or If-Modified-Since headers.

Recommendation

Update to version 1.4.0 or later.

NVD description