GHSA-cqr7-78pj-3g7jHigh

File Descriptor Leak Can Cause DoS Vulnerability in hapi

Published
October 24, 2017
Last Modified
April 11, 2023

🔗 CVE IDs covered (1)

CVE-2014-3742 →

📋 Description

Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.

When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.

Recommendation

  • Please upgrade to version 2.2.x or above as soon as possible.

🎯 Affected products1

  • npm/hapi:>= 2.0.0, < 2.2.0

🔗 References (6)