CVE-2017-16013
Denial of Service via malformed accept-encoding header in hapi
CVE-2017-16013 is a high vulnerability (CVSS 7.5) in Hapijs Hapi, published June 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 75th percentile. Fixed in hapi 16.1.1.
- Severity
- 7.5 HighCVSS 3.0, NVD
- Exploit chance
- 1.53%EPSS, 75th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
16.1.1hapi +1 more
Description
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
- Record
CVE-2017-16013- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-20
- Updated
- 2026-11-02
CVE ListNo score
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
- Record
CVE-2017-16013- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0581No score
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
- Record
EUVD-2018-0581- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqjg-whmm-8gv6
Denial of Service via malformed accept-encoding header in hapi
Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved.
Recommendation
Update to version 16.1.1 or later.
- Record
GHSA-cqjg-whmm-8gv6- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
- Record
CVE-2017-16013- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-cqjg-whmm-8gv6
Denial of Service via malformed accept-encoding header in hapi
Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved.
Recommendation
Update to version 16.1.1 or later.
- Record
GHSA-cqjg-whmm-8gv6- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.