GHSA-5854-jvxx-2cg9

Source

https://github.com/advisories/GHSA-5854-jvxx-2cg9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5854-jvxx-2cg9/GHSA-5854-jvxx-2cg9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5854-jvxx-2cg9

Published

2020-09-03T15:46:57Z

Modified

2025-09-29T20:49:54Z

Summary

Denial of Service in content

Details

Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.

Recommendation

This package is deprecated and is now maintained as @hapi/content. Please update your dependencies to use @hapi/content.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T19:00:47Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / content

Package

Name: content; View open source insights on deps.dev
Purl: pkg:npm/content

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

4.0.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5854-jvxx-2cg9/GHSA-5854-jvxx-2cg9.json"