In breve
- CVE-2017-16013 è una vulnerabilità ALTO (CVSS 7.5) che riguarda hapi (hapijs), hapi.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.2% delle vulnerabilità.
- Correzione: aggiornare a 16.1.1 o successiva.
| Package | Affected versions | Patched versions |
|---|
| hapi | ≥ 15.0.0, ≤ 16.1.0
| No fix yet |
| hapi npm | ≥ 15.0.0, < 16.1.1
| 16.1.1
|
Description
Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved.
Recommendation
Update to version 16.1.1 or later.
NVD description
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free