Hawk is an HTTP authentication scheme providing mechanisms for making
authenticated HTTP requests with partial cryptographic verification of
the request and response, covering the HTTP method, request URI, host,
and optionally the request payload. Hawk used a regular expression to
parse Host
HTTP header (Hawk.utils.parseHost()
), which was subject
to regular expression DoS attack - meaning each added character in the
attacker's input increases the computation time exponentially.
parseHost()
was patched in 9.0.1
to use built-in URL
class to
parse hostname instead. Hawk.authenticate()
accepts options
argument. If that contains host
and port
, those would be used
instead of a call to utils.parseHost()
. (CVE-2022-29167)