CVE-2017-16013

hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

• CWE-400
• CWE-20

• https://github.com/hapijs/hapi/issues/3466Third Party Advisory
• https://nodesecurity.io/advisories/335Third Party Advisory
• https://github.com/hapijs/hapi/issues/3466Third Party Advisory
• https://nodesecurity.io/advisories/335Third Party Advisory

Published

Jun 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16008i18next is a language translation framework. Because of how …
• CVE-2017-16009ag-grid is an advanced data grid that is library agnostic. a…6.1
• CVE-2017-1601IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 …
• CVE-2017-16010i18next is a language translation framework. When using the …
• CVE-2017-16011Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-16012Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-16014Http-proxy is a proxying library. Because of the way errors …7.5
• CVE-2017-16015Forms is a library for easily creating HTML forms. Versions …
• CVE-2017-16016Sanitize-html is a library for scrubbing html input of malic…
• CVE-2017-16017sanitize-html is a library for scrubbing html input for mali…
• CVE-2017-16018Restify is a framework for building REST APIs. Restify >=2.0…
• CVE-2017-16019GitBook is a command line tool (and Node.js library) for bui…