TI-2015-07620 Aliases CVE-2015-9241 GHSA-rc8h-3fv6-pxv8

Uncontrolled resource consumption in HackerOne hapi node module

LOW 37CWE-400Published 2018-05-29 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).

Why it matters now

EPSS 0.02063 81st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed hapi node module (HackerOne): 11.1.3hapi (npm): 11.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HackerOne	hapi node module	before 11.1.3	11.1.3	Patch available	CNA
—	hapi (npm)	before 11.1.3	11.1.3	Patch available	GHSA-rc8h-3fv6-pxv8

hapi node module VendorHackerOne Affected before 11.1.3 Fixed in 11.1.3 Patch available CNA
hapi (npm) Vendor— Affected before 11.1.3 Fixed in 11.1.3 Patch available GHSA-rc8h-3fv6-pxv8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hapijs:hapi::::::node.js::*	before 11.1.3	Vulnerable	hapijs

cpe:2.3:a:hapijs:hapi:*:*:*:*:*:node.js:*:* Versions before 11.1.3 Vulnerable ·hapijs

Remediation

Fix · CNA hapi node module (HackerOne) Fixed in 11.1.3
Fix · GHSA-rc8h-3fv6-pxv8 hapi (npm) Fixed in 11.1.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2015-9241
2026-10-03 Alias added: GHSA-rc8h-3fv6-pxv8

References

Exploit 1

https://github.com/jfhbrook/node-ecstatic/pull/179

Patch 1

https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580

Advisory 3

Other 1

https://www.npmjs.com/advisories/63

TI-2017-11738 Uncontrolled resource consumption in HackerOne hapi node module CVSS 3.0HIGH 7.5
TI-2015-07622 Improper access control in HackerOne hapi node module CVSS 3.0MEDIUM 5.9
TI-2015-07616 Improper access control in HackerOne hapi node module CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences