CVE-2017-16025

low-risk
Published 2018-06-04

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Nes

Affected Vendors

Hapijs

References (6)

Patch https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655
Third Party Advisory https://github.com/hapijs/nes/issues/171
Third Party Advisory https://nodesecurity.io/advisories/331
Patch https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655
Third Party Advisory https://github.com/hapijs/nes/issues/171
Third Party Advisory https://nodesecurity.io/advisories/331
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal