GHSA-4rgj-8mq3-hggj: 
JavaScript vulnerability analysis and mitigation

A high-severity Denial of Service (DoS) vulnerability was identified in @hapi/subtext package versions prior to 6.1.2. The vulnerability was discovered and reported on September 13, 2019, and was published to the GitHub Advisory Database on September 3, 2020. This security issue affects the npm package @hapi/subtext, which is a parsing module used in web applications (GitHub Advisory).

The vulnerability stems from a failure to properly enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This issue is classified as CWE-400 and has been assigned the identifier GHSA-4rgj-8mq3-hggj. The vulnerability has been rated as high severity, though no CVE ID has been assigned (GitHub Advisory).

The vulnerability allows attackers to send requests with arbitrary payload sizes, which can exhaust system resources leading to Denial of Service conditions. This could potentially affect the availability of applications using the vulnerable versions of the package (GitHub Advisory).

The vulnerability exists in all versions of @hapi/subtext prior to version 6.1.2. The issue specifically relates to the handling of chunked encoding payloads, which could be exploited by sending specially crafted requests to affected systems (GitHub Advisory).

Users are strongly recommended to upgrade to version 6.1.2 or later of @hapi/subtext, which contains the fix for this vulnerability. This version properly implements the maxBytes configuration for all types of payload encoding (GitHub Advisory).