GHSA-66mv-xh68-h6v2: 
JavaScript vulnerability analysis and mitigation

A high-severity Denial of Service vulnerability was identified in @commercial/hapi, tracked as GHSA-66mv-xh68-h6v2. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects multiple versions of the package: versions below 16.8.2, versions 17.0.0 to 17.9.2, versions 18.0.0 to 18.4.1, and versions 19.0.0 to 19.1.1 (GitHub Advisory).

The vulnerability exists in the CORS request handler of @commercial/hapi. When the header contains invalid values, the function throws a system error. In cases where no unhandled exception handler is present, this can cause the application to exit (GitHub Advisory).

The vulnerability can lead to a Denial of Service condition. If successfully exploited, an attacker can cause the application to shut down, disrupting service availability (GitHub Advisory).

The vulnerability can be triggered by sending requests with invalid header values to the CORS request handler. No specific exploit complexity details were provided in the advisory (GitHub Advisory).

Users are recommended to upgrade to the patched versions: 16.8.2, 17.9.2, 18.4.1, or 19.1.1 or later versions, depending on their current version (GitHub Advisory).