GHSA-23vw-mhv5-grv5: 
JavaScript vulnerability analysis and mitigation

A high-severity Denial of Service vulnerability was identified in the @hapi/hapi package, tracked as GHSA-23vw-mhv5-grv5. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects versions prior to 18.4.1 and versions between 19.0.0 and 19.1.1 of the @hapi/hapi package (GitHub Advisory).

The vulnerability exists in the CORS request handler of @hapi/hapi. When the header contains invalid values, the function throws a system error. In cases where no unhandled exception handler is present, this can cause the application to exit (GitHub Advisory).

If successfully exploited, this vulnerability allows attackers to cause a Denial of Service condition by sending specially crafted requests with invalid header values, potentially shutting down the affected services (GitHub Advisory).

The vulnerability can be triggered through manipulation of CORS request headers, requiring an attacker to send malformed requests to the affected application (GitHub Advisory).

Users are recommended to upgrade to the patched versions: either version 18.4.1 or 19.1.1 or later, which contain fixes for this vulnerability (GitHub Advisory).