CVE-2014-3742
File Descriptor Leak Can Cause DoS Vulnerability in hapi
CVE-2014-3742 is a medium vulnerability (CVSS 5.0) in Spumko Project Hapi Server Framework, published May 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in hapi 2.2.0.
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
- Record
CVE-2014-3742- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
- Record
CVE-2014-3742- Updated
- 2026-11-02
EUVDEUVD-2017-0221 No score
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
- Record
EUVD-2017-0221- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqr7-78pj-3g7j No score
File Descriptor Leak Can Cause DoS Vulnerability in hapi
Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.
When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.
Recommendation
- Please upgrade to version 2.2.x or above as soon as possible.
- Record
GHSA-cqr7-78pj-3g7j- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-cqr7-78pj-3g7j No score
File Descriptor Leak Can Cause DoS Vulnerability in hapi
Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.
When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.
Recommendation
- Please upgrade to version 2.2.x or above as soon as possible.
- Record
GHSA-cqr7-78pj-3g7j- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hapinpm |
2.0.0 up to 2.2.0 | 2.2.0 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2014/05/15/2
github.com/spumko/hapi/issues/1427
nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability
nvd.nist.gov/vuln/detail/CVE-2014-3742
npmjs.com/advisories/11