CVE-2015-9241

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-20

Affected software

Vendor	Product	Versions
HackerOne	hapi node module	<11.1.3

References

https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580Patch, Third Party Advisory
https://github.com/jfhbrook/node-ecstatic/pull/179Exploit, Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/63Third Party Advisory
https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580Patch, Third Party Advisory
https://github.com/jfhbrook/node-ecstatic/pull/179Exploit, Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/63Third Party Advisory

Timeline

Published: May 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92427.5Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. Th CVE-2015-92435.9When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher leve CVE-2015-92449.8Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.CVE-2015-92459.8Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URL CVE-2015-92469.8An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP f CVE-2015-92475.4An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/se CVE-2015-92485.4An issue was discovered in Skybox Platform before 7.5.201. Stored cross-site scripting vulnerabilities exist in the title, Comments, or Desc CVE-2015-92499.8An issue was discovered in Skybox Platform before 7.5.201. SQL Injection exists in /skyboxview/webservice/services/VersionWebService via a s CVE-2015-92507.5An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmentdownload and /skybo CVE-2015-92516.1jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType o CVE-2015-92525.5An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.CVE-2015-92536.5An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child