Read the docs
TI-2017-11738 Aliases CVE-2017-16013GHSA-cqjg-whmm-8gv6

Uncontrolled resource consumption in HackerOne hapi node module

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

Why it matters now

EPSS 0.01559 75th percentileScored 2026-11-07
Fix Fixed hapi (npm): 16.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOnehapi node module>= 15.0.0 <= 16.1.0—No fix listedCNA
—hapi (npm)15.0.0 to before 16.1.116.1.1Patch availableGHSA-cqjg-whmm-8gv6
  • hapi node module VendorHackerOne Affected >= 15.0.0 <= 16.1.0 Fixed in — No fix listed CNA
  • hapi (npm) Vendor— Affected 15.0.0 to before 16.1.1 Fixed in 16.1.1 Patch available GHSA-cqjg-whmm-8gv6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hapijs:hapi:*:*:*:*:*:node.js:*:*15.0.0 – 16.1.0Vulnerablehapijs
  • cpe:2.3:a:hapijs:hapi:*:*:*:*:*:node.js:*:* Versions 15.0.0 – 16.1.0 Vulnerable ·hapijs

Remediation

  • Fix · GHSA-cqjg-whmm-8gv6 hapi (npm) Fixed in 16.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-16013
  2. 2026-10-03 Alias added: GHSA-cqjg-whmm-8gv6

References

Advisory 4

Other 1

  • TI-2015-07620 Uncontrolled resource consumption in HackerOne hapi node module CVSS 3.0HIGH 7.5
  • TI-2015-07622 Improper access control in HackerOne hapi node module CVSS 3.0MEDIUM 5.9
  • TI-2015-07616 Improper access control in HackerOne hapi node module CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences