CVE-2015-9241

Vulnerability

In hapi versions prior to 11.1.3, the internal internals.marshal function directly passes user-controlled values from the If-Modified-Since and Last-Modified headers into Date.parse() without a try/catch guard. Certain date strings (e.g., '275760-09-24') cause V8 to throw an 'illegal access' exception instead of returning NaN [1][3]. This results in an uncaught exception that crashes the request handler.

Exploitation

An attacker can trigger this vulnerability by sending a crafted HTTP request containing a malicious If-Modified-Since or Last-Modified header with a date string known to cause an illegal access exception in V8 (e.g., '275760-09-24'). No authentication is required, and the attack can be performed over the network with a single HTTP request [3]. The server does not send an HTTP 500 error; instead, the socket remains open until the default Node.js socket timeout of 2 minutes elapses, allowing an attacker to exhaust server resources with repeated requests [1].

Impact

Successful exploitation leads to a denial of service (DoS) because the vulnerable process fails to cleanly close the connection and may crash or become unresponsive to legitimate requests. The attack can tie up server sockets, potentially consuming all available connections and preventing service to other users [1][2].

Mitigation

The vulnerability is fixed in hapi version 11.1.3, released on an unspecified date. The fix wraps the Date.parse() call in a try/catch block (new internals.parseDate function) so that invalid date strings are safely handled without throwing an exception [4]. Users should upgrade to hapi >= 11.1.3. No workaround is documented; if upgrading is not immediately possible, input validation on the affected headers may reduce risk but is not a complete solution.