Denial of Service in @commercial/subtext

Versions of @commercial/subtext prior to 5.1.1 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may...

GHSA-4RGJ-8MQ3-HGGJ Denial of Service in @hapi/subtext

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust...

Denial of Service in @hapi/subtext

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust...

GHSA-36C4-4R89-6WHG Prototype Pollution in @commercial/subtext

Versions of @commercial/subtext prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

GHSA-G9CG-H3JM-CWRC Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

Prototype Pollution in pez

All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If...

GHSA-G64Q-3VG8-8F93 Prototype Pollution in pez

All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If...

Denial of Service in content

Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expected application...

GHSA-CVFM-XJC8-F2VM Denial of Service in @commercial/subtext

Version 5.1.1 of @commercial/subtext is vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expecte...

Denial of Service in @hapi/content

Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

GHSA-3WQH-H42R-X8FQ Denial of Service in @hapi/content

Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

PT-2020-21028

Name of the Vulnerable Software and Affected Versions @hapi/subtext versions prior to 6.1.2 Description The issue allows attackers to send requests with arbitrary payload sizes, potentially exhausting system resources and leading to Denial of Service. This is due to the failure to enforce the...

PT-2020-21284

Name of the Vulnerable Software and Affected Versions @commercial/subtext versions prior to 5.1.1 Description The issue allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service. This is due to the package's failure to enforce...

PT-2020-21054

Name of the Vulnerable Software and Affected Versions subtext versions 4.1.0 and later Description The issue affects the Content-Encoding HTTP header parser, which can cause a system error when encountering invalid values in the header. This error is not caught and can propagate up the stack,...

PT-2020-21297

Name of the Vulnerable Software and Affected Versions subtext versions affected versions not specified Description The issue concerns Prototype Pollution, where a specially crafted multipart payload can manipulate the payload object's prototype, potentially bypassing access and privacy validation...

PT-2020-21303

Name of the Vulnerable Software and Affected Versions @hapi/subtext versions prior to 6.1.3 @hapi/subtext versions prior to 7.0.3 Description The issue allows a multipart payload to be constructed in a way that one of the parts' content can be set as the entire payload object's prototype. If this...

PT-2020-21254

Name of the Vulnerable Software and Affected Versions @commercial/subtext version 5.1.1 Description The Content-Encoding HTTP header parser in the @commercial/subtext module has a vulnerability that can cause a system error when encountering invalid values in the header. This error can lead to th...

PT-2020-20978

Name of the Vulnerable Software and Affected Versions @commercial/subtext versions prior to 5.1.2 Description The issue allows a multipart payload to be constructed in a way that one of the parts' content can be set as the entire payload object's prototype. If this prototype contains data, it may...

PT-2020-20997

Name of the Vulnerable Software and Affected Versions @hapi/subtext versions prior to 6.1.3 @hapi/subtext versions prior to 7.0.3 Description The Content-Encoding HTTP header parser in @hapi/subtext has a vulnerability that can cause a system error when the header contains invalid values. This...