In short
- CVE-2017-16013 is a HIGH (CVSS 7.5) vulnerability affecting hapi (hapijs), hapi.
- Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.2% of all vulnerabilities.
- Fix: update to 16.1.1 or later.
| Package | Affected versions | Patched versions |
|---|
| hapi | ≥ 15.0.0, ≤ 16.1.0
| No fix yet |
| hapi npm | ≥ 15.0.0, < 16.1.1
| 16.1.1
|
Description
Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved.
Recommendation
Update to version 16.1.1 or later.
NVD description
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free