style-pot (>=0.0.15, <=0.0.22), toolbag (>=0.14.0, <=1.0.0) +3 more potentially affected by CVE-2017-16025 via nes (>=6.2.1, <=6.3.1)

nes NPM version =6.2.1, =0.0.15, =0.14.0, =0.0.5, =0.0.13 Source cves: CVE-2017-16025 Source advisory: OSV:GHSA-3PWH-5MMC-MWRX...

CVE-2017-16025

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to cookie. Submitting an invalid cookie on the websocket...

CVE-2017-16025

Summary : The vulnerability affects the Nes WebSocket extension for hapi. Versions up to and including 6.4.0 are susceptible to a denial-of-service when websocket authentication uses a cookie and an invalid cookie is submitted during the upgrade request, causing the node process to error/terminat...