GHSA-jcpv-g9rr-qxrcHighCVSS 7.5

Regular Expression Denial of Service in hawk

Published
July 31, 2018
Last Modified
April 11, 2023

🔗 CVE IDs covered (1)

CVE-2016-2515 →

📋 Description

Versions of hawk prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long headers and URI's.

Recommendation

Update to hawk version 4.1.1 or later.

🎯 Affected products2

  • npm/hawk:< 3.1.3
  • npm/hawk:>= 4.0.0, < 4.1.1

🔗 References (8)