CVE-2017-16025 Denial of Service in nes
An attacker can crash the Node.js process by sending an invalid cookie header during WebSocket upgrade when cookie authentication is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16025?
CVE-2017-16025 is a medium-severity denial of service vulnerability in HackerOne nes node module, published on 4 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.
Which versions are affected by CVE-2017-16025?
2 open source packages ship an affected version, including nes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nes npm | All versions | 6.4.1 |
nes npm | All versions | 6.4.1 |
Products include Hapijs Nes.
How do I fix CVE-2017-16025?
Upgrade nes to 6.4.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-16025 being exploited?
There is no known exploitation of CVE-2017-16025 in the wild and no public exploit code.
Sources
Also known as GHSA-3pwh-5mmc-mwrx.