GHSA-9vrw-m88g-w75q: 
JavaScript vulnerability analysis and mitigation

A high-severity Denial of Service vulnerability was identified in the @hapi/accept npm package (GHSA-9vrw-m88g-w75q). The vulnerability affects versions >= 3.2.0, < 3.2.4 and >= 4.0.0, < 5.0.1 of the package. The issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023 (GitHub Advisory).

The vulnerability exists in the Accept-Encoding HTTP header parser of the @hapi/accept package. When the header contains invalid values, the parser throws a system error. Due to hapi's error handling mechanism, which rethrows system errors instead of catching expected application errors, these errors propagate up the stack. This behavior occurs in versions prior to 3.2.4 or 5.0.1 (GitHub Advisory).

If no unhandled exception handler is present in the application, the system error can cause the application to exit, effectively allowing attackers to shut down services through a denial of service attack (GitHub Advisory).

The vulnerability can be triggered by sending HTTP requests with specially crafted invalid Accept-Encoding headers to applications using vulnerable versions of the @hapi/accept package (GitHub Advisory).

Users are recommended to upgrade to the patched versions: either version 3.2.4 or 5.0.1, which have fixed this vulnerability (GitHub Advisory).