CVE-2015-9242 Denial of Service in ecstatic
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm ecstatic(npm) | < 1.4.0 | 1.4.0 |
| ecstatic project ecstatic | < 1.4.0 | 1.4.0 |
| HackerOne ecstatic node module | = <1.4.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com issue-tracking patch third-party-advisory
- bugs.chromium.org issue-tracking third-party-advisory
- github.com patch
- github.com
- nodesecurity.io third-party-advisory