CVE-2017-16025: Hapijs Nes

Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days.

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.

Affected products

• Hapijs Nes: up to and including 6.4.0

Published 2018-06-04. Last modified 2026-06-17.