CVE-2017-16013: Hapijs Hapi

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

Affected products

• Hapijs Hapi: from 15.0.0, up to and including 16.1.0

Published 2018-06-04. Last modified 2026-06-17.