Denial of Service in newRequest about node-server HOT 10 CLOSED

Hi @y0d3n

Thanks for the report!
You're right about "Host: example.com/bbb?" too, I think it should be an error.
We will start to fix it immediately.

from node-server.

At the moment, I would like to finalise the following changes.

main...usualoma:node-server:fix-invalid-incoming-request

from node-server.

I've published the report and requested the CVE number:

GHSA-hgxw-5xg3-69jx

from node-server.

Oh! I am very happy😆
Thank you very much!

from node-server.

Hi @Yovach

Thank you for raising the issue.

@usualoma Can you take a look at this?

from node-server.

#160 will also need to be considered together.

from node-server.

I've created #162

#162 would be able to be released immediately in a patch version, as it only suppresses the abnormal termination and does not change the behaviour.

#160 and #161 may have edge cases affected by the change, so it would be better to calm down and fix them in the next minor version.

from node-server.

Thanks for the quick fix.
Can I request CVE number for DoS? (Or after the related issue has been resolved?)

from node-server.

And created #163

@y0d3n Thank you for offering. I appreciate it.

Can I request CVE number for DoS? (Or after the related issue has been resolved?)

It would be good to release a more secure version with #163 first and then promote the update to users.

@yusukebe What do you think?

from node-server.

Hi @y0d3n

I'm creating the report to request the CVE number for this issue.

from node-server.