CVE-2017-16013: hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is…

PriorityP434high7.5CVSS 3.0

AVNACLPRNUINSUCNINAH

EPSS

1.58%

72.8th percentile

hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
hackerone	hapi_node_module	—	—
hapijs	hapi	>= 15.0.0 < 16.1.1	16.1.1
hapijs	hapi	15.0.0 – 16.1.0	—

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.