Description
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | hapi node module | <11.1.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | hapi | < 11.1.3 | 11.1.3 | GHSA-rc8h-3fv6-pxv8 |