| Package | Affected versions | Patched versions |
|---|---|---|
| mongoose | < 7.10 | 7.10 |
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free