File Descriptor Leak Can Cause DoS Vulnerability in hapi (GHSA-cqr7-78pj-3g7j)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-3742
Severity: HIGH · CWE: CWE-400

Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak. 

When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.



## Recommendation

- Please upgrade to version 2.2.x or above as soon as possible.

Affected packages:
package: ecosystem: npm
name: hapi
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.2.0