What is GHSA-66mv-xh68-h6v2?

GHSA-66mv-xh68-h6v2 is a security advisory published by GitHub Security Advisories with High severity. Denial of Service in @commercial/hapi

Why does GHSA-66mv-xh68-h6v2 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-66mv-xh68-h6v2?

GHSA-66mv-xh68-h6v2 affects 4 products, including: npm/@commercial/hapi:\u003c 16.8.2; npm/@commercial/hapi:\u003e= 17.0.0, \u003c 17.9.2; npm/@commercial/hapi:\u003e= 18.0.0, \u003c 18.4.1; npm/@commercial/hapi:\u003e= 19.0.0, \u003c 19.1.1.

GHSA-66mv-xh68-h6v2HighDisclosed before NVD

Denial of Service in @commercial/hapi

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.

Recommendation

Upgrade to versions 16.8.2, 17.9.2, 18.4.1, 19.1.1 or later.

🎯 Affected products4

npm/@commercial/hapi:< 16.8.2
npm/@commercial/hapi:>= 17.0.0, < 17.9.2
npm/@commercial/hapi:>= 18.0.0, < 18.4.1
npm/@commercial/hapi:>= 19.0.0, < 19.1.1

🔗 References (2)

https://www.npmjs.com/advisories/1483
https://github.com/advisories/GHSA-66mv-xh68-h6v2