GHSA-vwjc-q9px-r9vq

    Dashboard / Vulnerabilities / GHSA-vwjc-q9px-r9vq

    GHSA-vwjc-q9px-r9vq

    Published: 7 Jun 2018Last Modified: 8 Nov 2023
    Aliases:
    CVE-2015-9242

    Summary: Denial of Service in ecstatic

    Details: Versions of `ecstatic` prior to 1.4.0 are affected by a denial of service vulnerability when certain input strings are sent via the `Last-Modified` or `If-Modified-Since` headers. Parsing certain inputs with `new Date()` or `Date.parse()` cases v8 to crash. As ecstatic passes the value of the affected headers into one of these functions, sending certain inputs via one of the headers will cause the server to crash. ## Recommendation Update to version 1.4.0 or later.

    References: https://nvd.nist.gov/vuln/detail/CVE-2015-9242, https://github.com/jfhbrook/node-ecstatic/pull/179, https://github.com/jfhbrook/node-ecstatic/commit/0d0a2779ac5e5843d3745920212dfac9b69440e2, https://bugs.chromium.org/p/v8/issues/detail?id=4640, https://github.com/jfhbrook/node-ecstatic

    Affected packages

    Package

    Name: ecstatic

    Purl: pkg:npm/ecstatic

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.4.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High