--- title: "CX-2016-4450" date: "2017-12-13T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2016-4450/" --- # CX-2016-4450 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Aug 9, 2016 CVE-2016-10703 **Published:** Dec 13, 2017 7.5 High Severity dos ecstatic npm EY Erez Yalon Reported by Checkmarx Zero Details Overview ## Summary A Denial of Service (DoS) vulnerability in the file ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string. ## Product Ecstatic before 2.0.0 ## Impact If exploited, a threat actor will be to crash an application using that uses a vulnerable version of the ecstatic npm package, causing a Denial of Service and thus compromising the availability of the application. ## Steps to reproduce The vulnerable function uses a loop to replace null bytes in the URL string, as can be seen in the following snippet of the library: ``` // Strip any null bytes from the url while(req.url.indexOf('%00') !== -1 ) { req.url = req.url.replace(/%00/g,''); } ``` Since the application also does not validate the url length at any point, the flow of the execution will continue until it does not find any more null bytes. In order to exploit this issue, a threat actor may perform the following request, with arbitrary null bytes appended: ``` https://localhost:8080//%00%00%00%00%00%00... ``` ### Expected result A payload of 22kB caused a lag of 1 second, A payload of 35kB caused a lag of 3 seconds, A payload of 86kB caused the server to crash due to memory shortage. ## Remediation Update ecstatic dependency to 2.0.0 and above ## Credit This issue was discovered and reported by Checkmarx Security Researcher [@erezyalon (Erez Yalon)](https://twitter.com/erezyalon). ## Resources 1. [71ce939](https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01) 0 High Severity CVSS v3.1 Score 7.5 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High Advisory Timeline1. Discovered Aug 9, 2016 2. Fixed Aug 9, 2016 Fixed version in v2.0.0 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)