CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2016-2515
Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.
Severity
- EPSS
- 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-399
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hawk_project:hawk
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jcpv-g9rr-qxrc | npm | hawk | >=4.0.0 <4.1.1 | 4.1.1 |
| GHSA-jcpv-g9rr-qxrc | npm | hawk | <3.1.3 | 3.1.3 |