Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Hapi Web Framework Crashes or Hangs with Malformed HTTP Headers

CVE-2017-16013 · published 8 years ago
Summary

If your web application uses hapi version 15.0.0 to 16.1.0 and receives a corrupted HTTP request header, it may stop working or become unresponsive. This could cause downtime or impact user experience. Update to a fixed version of hapi to prevent this issue.

What to do
  • Update hueniverse hapi to version 16.1.1.
Affected software
Ecosystem VendorProductAffected versions
npm hueniverse hapi >= 15.0.0, <= 16.1.0
Fix: upgrade to 16.1.1
– hapijs hapi >= 15.0.0, <= 16.1.0
cpe:2.3:a:hapijs:hapi:*:*:*:*:*:node.js:*:*
Original advisory text
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to h...
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
CWE-20Improper Input Validation
Timeline
Published4 Jun 2018
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-cqjg-whmm-8gv6 · GHSA
CVE-2017-16013 · NVD
Track software like this
Free during beta