| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| @hapi/content | < 6.0.1 | 6.0.1 |
All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1.
Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value.
Fixed by tightening all three regular expressions to eliminate backtracking.
There are no known workarounds. Upgrade to the patched version.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン