GMS-2015-54: Denial of service - Potential socket exhaustion

December 23, 2015

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an ‘illegal access’ exception to be raised. Instead of sending a HTTP error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).

References

github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580
github.com/jfhbrook/node-ecstatic/pull/179

Code Behaviors & Features

Detect and mitigate GMS-2015-54 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →