CVE-2015-9241
Denial of Service in hapi
CVE-2015-9241 is a high vulnerability (CVSS 7.5) in Hackerone Hapi Node Module, published May 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in hapi 11.1.3.
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
- Record
CVE-2015-9241- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-20
- Updated
- 2026-11-02
CVE List No score
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
- Record
CVE-2015-9241- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0200 No score
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
- Record
EUVD-2018-0200- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rc8h-3fv6-pxv8 No score
Denial of Service in hapi
Versions of hapi prior to 11.1.3 are affected by a denial of service vulnerability.
The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers.
This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Recommendation
Update to v11.1.3 or later
- Record
GHSA-rc8h-3fv6-pxv8- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-rc8h-3fv6-pxv8 No score
Denial of Service in hapi
Versions of hapi prior to 11.1.3 are affected by a denial of service vulnerability.
The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers.
This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Recommendation
Update to v11.1.3 or later
- Record
GHSA-rc8h-3fv6-pxv8- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hapinpm |
before 11.1.3 | 11.1.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |