CVE-2015-9241: Improper Input Validation

June 7, 2018 (updated January 8, 2021)

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an ‘illegal access’ exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).

References

github.com/advisories/GHSA-rc8h-3fv6-pxv8
github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580
github.com/jfhbrook/node-ecstatic/pull/179
nodesecurity.io/advisories/63
nodesecurity.io/advisories/64
nvd.nist.gov/vuln/detail/CVE-2015-9241
www.npmjs.com/advisories/63

Code Behaviors & Features

Detect and mitigate CVE-2015-9241 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →