CVE-2014-3742
File Descriptor Leak Can Cause DoS Vulnerability in hapi
CVE-2014-3742 is a medium vulnerability (CVSS 5.0) in Spumko Project Hapi Server Framework, published May 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 84th percentile. Fixed in hapi 2.2.0.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.37%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.0hapi
Description
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hapinpm | 2.0.0 up to 2.2.0 | 2.2.0 |
What each source reports
NVD Score used
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
- Record
CVE-2014-3742- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE ListNo score
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
- Record
CVE-2014-3742- Updated
- 2026-11-02
EUVDEUVD-2017-0221No score
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
- Record
EUVD-2017-0221- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqr7-78pj-3g7jNo score
File Descriptor Leak Can Cause DoS Vulnerability in hapi
Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.
When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.
Recommendation
- Please upgrade to version 2.2.x or above as soon as possible.
- Record
GHSA-cqr7-78pj-3g7j- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-cqr7-78pj-3g7jNo score
File Descriptor Leak Can Cause DoS Vulnerability in hapi
Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak.
When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.
Recommendation
- Please upgrade to version 2.2.x or above as soon as possible.
- Record
GHSA-cqr7-78pj-3g7j- Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2014/05/15/2
github.com/spumko/hapi/issues/1427
nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability
nvd.nist.gov/vuln/detail/CVE-2014-3742
npmjs.com/advisories/11