What is GHSA-3pwh-5mmc-mwrx?

GHSA-3pwh-5mmc-mwrx is a security advisory published by GitHub Security Advisories with High severity. Denial of Service in nes

Which CVE IDs does GHSA-3pwh-5mmc-mwrx cover?

GHSA-3pwh-5mmc-mwrx covers the following CVE IDs: CVE-2017-16025. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3pwh-5mmc-mwrx?

GHSA-3pwh-5mmc-mwrx affects 1 product, including: npm/nes:\u003c= 6.4.0.

GHSA-3pwh-5mmc-mwrxHigh

Denial of Service in nes

Vendor

GitHub Security Advisories

Published

July 24, 2018

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2017-16025 →

📋 Description

Affected versions of nes are vulnerable to denial of service when given an invalid cookie header, and websocket authentication is set to cookie. Submitting an invalid cookie on the websocket upgrade request will cause the node process to throw and exit.

Recommendation

Update to version 6.4.1 or later.

🎯 Affected products1

npm/nes:<= 6.4.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-16025
https://github.com/hapijs/nes/issues/171
https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655
https://github.com/advisories/GHSA-3pwh-5mmc-mwrx
https://www.npmjs.com/advisories/331