GHSA-3wqh-h42r-x8fq

Suggest an improvement
Source
https://github.com/advisories/GHSA-3wqh-h42r-x8fq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-3wqh-h42r-x8fq/GHSA-3wqh-h42r-x8fq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3wqh-h42r-x8fq
Published
2020-09-03T15:46:22Z
Modified
2025-09-25T22:29:15Z
Summary
Denial of Service in @hapi/content
Details

Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.

Recommendation

Upgrade to version 5.0.2. Versions 4.1.1 and 5.0.1 are fixed but only available for direct download through the repository.

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T19:00:42Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / @hapi/content

Package

Name
@hapi/content
View open source insights on deps.dev
Purl
pkg:npm/%40hapi/content

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-3wqh-h42r-x8fq/GHSA-3wqh-h42r-x8fq.json"