GHSA-3wqh-h42r-x8fq: 
JavaScript vulnerability analysis and mitigation

A high-severity Denial of Service vulnerability was identified in @hapi/subtext, tracked as GHSA-3wqh-h42r-x8fq. The vulnerability affects versions >= 4.1.0, < 6.1.3 and >= 7.0.0, < 7.0.3 of the package. The issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023 (GitHub Advisory).

The vulnerability exists in the Content-Encoding HTTP header parser of @hapi/subtext. When the header contains invalid values, the parser throws a system error. Due to hapi's error handling mechanism, which rethrows system errors instead of catching expected application errors, these errors propagate up the stack (GitHub Advisory).

If no unhandled exception handler is present in the application, the system error can cause the application to exit, effectively allowing attackers to shut down services through a denial of service attack (GitHub Advisory).

The vulnerability can be triggered by sending HTTP requests with specially crafted invalid Content-Encoding header values to applications using affected versions of @hapi/subtext (GitHub Advisory).

Users are recommended to upgrade to the patched versions: either version 6.1.3 or 7.0.3, depending on their current version (GitHub Advisory).