{"id":"GHSA-pm9p-9926-w68m","summary":"Denial of Service in ecstatic","details":"`ecstatic`, a simple static file server middleware, is vulnerable to denial of service. If a payload with a large number of null bytes (`%00`) is provided by an attacker it can crash ecstatic by running it out of memory.\n\n\n[Results from the original advisory](https://www.checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package/)\n\n```\nA payload of 22kB caused a lag of 1 second,\nA payload of 35kB caused a lag of 3 seconds,\nA payload of 86kB caused the server to crash\n```\n\n\n## Recommendation\n\nUpdate to version 2.0.0 or later.","aliases":["CVE-2016-10703"],"modified":"2023-11-01T04:46:44.579296Z","published":"2017-12-28T22:52:47Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:49:34Z","nvd_published_at":"2017-12-14T19:29:00Z","cwe_ids":["CWE-400"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10703"},{"type":"WEB","url":"https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01"},{"type":"WEB","url":"https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01#diff-b2b5a88fb51675f1aa1065c093dce1ee"},{"type":"WEB","url":"https://advisory.checkmarx.net/advisory/CX-2016-4450"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pm9p-9926-w68m"},{"type":"PACKAGE","url":"https://github.com/jfhbrook/node-ecstatic"},{"type":"WEB","url":"https://www.checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package"},{"type":"WEB","url":"https://www.npmjs.com/advisories/553"}],"affected":[{"package":{"name":"ecstatic","ecosystem":"npm","purl":"pkg:npm/ecstatic"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-pm9p-9926-w68m/GHSA-pm9p-9926-w68m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}