Improper Input Handling in Hapi Node Module Affecting Multiple Applications

CVE-2015-9241

What is CVE-2015-9241?

The Hapi Node module prior to version 11.1.3 contains a flaw that arises when processing certain inputs in the If-Modified-Since or Last-Modified headers. This vulnerability can lead to an 'illegal access' exception being triggered. Rather than returning a standard HTTP 500 error to the requester, the module will maintain the socket connection until it naturally times out, which defaults to two minutes. This extended socket hold can potentially be exploited by attackers to disrupt service by consuming server resources.

References