En resumen
- CVE-2017-16013 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a hapi (hapijs), hapi.
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.6%, mayor que el 75.2% de las vulnerabilidades.
- Solución: actualizar a 16.1.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| hapi | ≥ 15.0.0, ≤ 16.1.0
| No fix yet |
| hapi npm | ≥ 15.0.0, < 16.1.1
| 16.1.1
|
Description
Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved.
Recommendation
Update to version 16.1.1 or later.
NVD description
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free