{"id":"CVE-2022-29167","aliases":["CLSA-2026-1772583205","CLSA-2026-1773015258","CLSA-2026-1774743811","CLSA-2026-1774743812","CLSA-2026-1774743813","CLSA-2026-1776818225","DEBIAN-CVE-2022-29167","DLA-3246-1","EUVD-2022-2298","GHSA-44pw-h2cw-w3vq","MGASA-2024-0086","OESA-2022-1667","UBUNTU-CVE-2022-29167","USN-6116-1"],"status":"published","title":"ReDoS vulnerability in header parsing in hawk","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01101,"percentile":0.65973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-05-05T22:55:10Z","modified":"2026-11-03T08:02:17Z","fixes":[{"ecosystem":"npm","package":"hawk","fixed_in":["9.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"hawk","fixed_in":["3.1.3-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-hawk","fixed_in":["9.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-hawk","fixed_in":["9.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-hawk","fixed_in":["9.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"node-hawk","fixed_in":["6.0.1+dfsg-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"nodejs-hawk","fixed_in":["7.0.10-4.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-hawk","fixed_in":["4.1.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-hawk","fixed_in":["4.1.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs-hawk","fixed_in":["4.1.2-2.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"node-hawk","fixed_in":["6.0.1+dfsg-1+deb10u1build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"node-hawk","fixed_in":["7.1.2+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"node-hawk","fixed_in":["8.0.1+dfsg-1ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.1"}]}],"versions":["2.3.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.1"}]}],"versions":["3.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.1-tuxcare.0"},{"fixed":"0.13.1-tuxcare.1"}]}],"versions":["0.13.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-tuxcare.0"},{"fixed":"1.0.0-tuxcare.1"}]}],"versions":["1.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1-tuxcare.0"},{"fixed":"1.1.1-tuxcare.1"}]}],"versions":["1.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.3"}]}],"versions":["3.1.3","3.1.3-tuxcare.1","3.1.3-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1+dfsg-1+deb10u1"}]}],"versions":["6.0.1+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"hawk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.10-4.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-2.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1+dfsg-1+deb10u1build0.18.04.1"}]}],"versions":["6.0.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+dfsg-1ubuntu0.1"}]}],"versions":["7.1.1+dfsg-2","7.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1+dfsg-1ubuntu0.22.04.1"}]}],"versions":["8.0.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1+dfsg-1+deb10u1build0.18.04.1"}]}],"versions":["6.0.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+dfsg-1ubuntu0.1"}]}],"versions":["7.1.1+dfsg-2","7.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-hawk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1+dfsg-1ubuntu0.22.04.1"}]}],"versions":["8.0.1+dfsg-1"]}],"products":[{"vendor":"mozilla","product":"hawk"}],"references":[{"url":"https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/mozilla/hawk/pull/286","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29167","tags":["advisory"]},{"url":"https://github.com/mozilla/hawk/commit/d10d72ca82db967f6c5fcf866ff78e3ca25ce1ab","tags":["web"]},{"url":"https://github.com/advisories/GHSA-44pw-h2cw-w3vq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29167.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-29167","tags":["advisory"]},{"url":"https://github.com/mozilla/hawk","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0086.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31313","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-3246","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-6116-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1667","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-29167","tags":["report"]},{"url":"https://github.com/mozilla/hawk/commit/ade134119bf1fdc4909d00f5a952c966f0075ad3","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29167","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-29167","title":"ReDoS vulnerability in header parsing in hawk","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-05T22:55:10Z","modified":"2025-04-23T18:30:44.456Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-2298","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-05T22:55:10Z","modified":"2025-04-23T18:30:44Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:08.401317Z"}],"ghsa":[{"id":"GHSA-44pw-h2cw-w3vq","title":"Uncontrolled Resource Consumption in Hawk","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead.`Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-23T20:18:14Z","modified":"2023-11-29T20:37:22Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:37:22.840002Z"}],"nvd":[{"id":"CVE-2022-29167","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-05T23:15:09.083Z","modified":"2026-06-17T04:39:43.723Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:07:19.51203Z"}],"osv":[{"id":"CVE-2022-29167","title":"ReDoS vulnerability in header parsing in hawk","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-05T22:55:10Z","modified":"2026-10-28T02:31:02.248503078Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"DEBIAN-CVE-2022-29167","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-05T23:15:09.083Z","modified":"2026-11-03T08:02:17.540557303Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-44pw-h2cw-w3vq","title":"Uncontrolled Resource Consumption in Hawk","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead.`Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-23T20:18:14Z","modified":"2023-11-08T04:09:08.620639Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"OESA-2022-1667","title":"nodejs-hawk security update","description":"Hawk is an HTTP authentication scheme using a message authentication code (MAC) algorithm to provide partial HTTP request cryptographic verification.\n\nSecurity Fix(es):\n\nHawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse Host HTTP header (Hawk.utils.parseHost()), which was subject to regular expression DoS attack - meaning each added character in the attacker s input increases the computation time exponentially. parseHost() was patched in 9.0.1 to use built-in URL class to parse hostname instead. Hawk.authenticate() accepts options argument. If that contains host and port, those would be used instead of a call to utils.parseHost().(CVE-2022-29167)","status":"published","published":"2022-05-20T11:04:56Z","modified":"2026-08-18T01:16:33.183846538Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-29167","description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","status":"published","published":"2022-05-05T23:15:00Z","modified":"2026-02-04T03:56:02.354564Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CLSA-2026-1772583205","title":"TuxCare security update for hawk (2 CVEs)","description":"TuxCare rebuilt hawk to address 2 CVEs. Fixed in 2.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:42.101300215Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773015258","title":"TuxCare security update for hawk (2 CVEs)","description":"TuxCare rebuilt hawk to address 2 CVEs. Fixed in 3.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:42.104052767Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1774743811","title":"TuxCare security update for hawk (2 CVEs)","description":"TuxCare rebuilt hawk to address 2 CVEs. Fixed in 0.13.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.474624154Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743812","title":"TuxCare security update for hawk (2 CVEs)","description":"TuxCare rebuilt hawk to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.499859612Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743813","title":"TuxCare security update for hawk (2 CVEs)","description":"TuxCare rebuilt hawk to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.406639226Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776818225","title":"TuxCare security update for hawk (1 CVE)","description":"TuxCare rebuilt hawk to address 1 CVE. Fixed in 3.1.3-tuxcare.3.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:47.200450934Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-3246-1","title":"node-hawk - security update","status":"published","published":"2022-12-23T00:00:00Z","modified":"2026-03-09T01:22:10.292374Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2024-0086","title":"Updated nodejs-hawk packages fix security vulnerability","description":"Hawk is an HTTP authentication scheme providing mechanisms for making\nauthenticated HTTP requests with partial cryptographic verification of\nthe request and response, covering the HTTP method, request URI, host,\nand optionally the request payload. Hawk used a regular expression to\nparse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject\nto regular expression DoS attack - meaning each added character in the\nattacker's input increases the computation time exponentially.\n`parseHost()` was patched in `9.0.1` to use built-in `URL` class to\nparse hostname instead. `Hawk.authenticate()` accepts `options`\nargument. If that contains `host` and `port`, those would be used\ninstead of a call to `utils.parseHost()`. (CVE-2022-29167)\n","status":"published","published":"2024-03-24T04:57:19Z","modified":"2026-04-16T04:44:26.740362076Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"USN-6116-1","title":"node-hawk vulnerability","description":"It was discovered that hawk incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2023-05-30T09:09:52Z","modified":"2026-02-10T04:43:08Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}