GHSA-rhc3-76jw-4f2x: 
JavaScript vulnerability analysis and mitigation

A high-severity Denial of Service vulnerability was identified in the @commercial/ammo npm package, tracked as GHSA-rhc3-76jw-4f2x. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 4, 2020, and affects all versions prior to 2.1.1 (GitHub Advisory).

The vulnerability exists in the Range HTTP header parser of the @commercial/ammo package. When the header is set to an invalid value, the parser function throws a system error. Due to improper error handling in the hapi framework, this error propagates up the stack without being caught. The vulnerability has been classified as high severity (GitHub Advisory).

If no unhandled exception handler is present in the application, the thrown error can cause the application to exit completely, enabling attackers to shut down services. This creates a significant availability risk for affected applications (GitHub Advisory).

An attacker can exploit this vulnerability by sending requests with invalid Range HTTP headers to affected services. The exploitation requires minimal technical expertise as it only involves manipulating HTTP headers (GitHub Advisory).

Users are strongly recommended to upgrade to version 2.1.1 or later of the @commercial/ammo package, which contains the fix for this vulnerability (GitHub Advisory).