-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lite-web-server | npm | <= 1.2.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from line 274 of WebServer.js where decodeURIComponent() is directly applied to req.url. This function throws URIError when encountering invalid encoded URI components, which isn't caught by any try/catch block. Attackers can exploit this by sending specially crafted URLs with invalid encoding, causing unhandled exceptions that terminate the server process. The advisory explicitly references this line, and the lack of error handling around URI decoding is a well-known pattern for DoS vulnerabilities in Node.js servers.