GHSA-xgp2-cc4r-7vf6 Denial of Service in http-live-simulator
An attacker can crash the server by sending a specific HTTP request due to unhandled exceptions in the http-live-simulator library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xgp2-cc4r-7vf6?
GHSA-xgp2-cc4r-7vf6 is a denial of service vulnerability in http-live-simulator, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of http-live-simulator prior to 1.0.8 are vulnerable to Denial of Service. The package fails to catch an exception that causes the Node process to crash, effectively shutting down the server. This allows an attacker to send an HTTP request that crashes the server.
Recommendation
Upgrade to version 1.0.8 or later.
Which versions are affected by GHSA-xgp2-cc4r-7vf6?
2 open source packages ship an affected version, including http-live-simulator.
| Package | Affected | Fixed in |
|---|---|---|
http-live-simulator npm | All versions | 1.0.8 |
http-live-simulator npm | All versions | 1.0.8 |
How do I fix GHSA-xgp2-cc4r-7vf6?
Upgrade http-live-simulator to 1.0.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-xgp2-cc4r-7vf6 being exploited?
There is no known exploitation of GHSA-xgp2-cc4r-7vf6 in the wild and no public exploit code.