Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
32 vulnerabilities by hapijs
CVE-2026-84368 (GCVE-0-2026-84368)
Vulnerability from nvd – Published: 2026-09-01 20:36 – Updated: 2026-09-02 12:18
VLAI
EPSS
VEX
Title
joi: Prototype pollution via a `__proto__` language key in custom messages
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 12:11 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3138 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3139 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/8d0b808f3e87… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/90d07571923c… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T12:11:08.547444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:18:07.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c= 17.1.1"
},
{
"status": "affected",
"version": "\u003e= 17.2.0, \u003c 17.13.6"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function\u0027s static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:36:51.859Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"
},
{
"name": "https://github.com/hapijs/joi/pull/3138",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3138"
},
{
"name": "https://github.com/hapijs/joi/pull/3139",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3139"
},
{
"name": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"
},
{
"name": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"
}
],
"source": {
"advisory": "GHSA-6w3j-5fw6-r9vr",
"discovery": "UNKNOWN"
},
"title": "joi: Prototype pollution via a `__proto__` language key in custom messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84368",
"datePublished": "2026-09-01T20:36:51.859Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-02T12:18:07.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84367 (GCVE-0-2026-84367)
Vulnerability from nvd – Published: 2026-09-01 20:33 – Updated: 2026-09-01 20:33
VLAI
EPSS
VEX
Title
joi: object().rename() with a template target can set the validated object's prototype
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Severity
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3134 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3135 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/162f367aa178… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/172ececa192f… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 17.13.5"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi\u0027s lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern\u0027s own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:33:29.295Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"
},
{
"name": "https://github.com/hapijs/joi/pull/3134",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3134"
},
{
"name": "https://github.com/hapijs/joi/pull/3135",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3135"
},
{
"name": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"
},
{
"name": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"
}
],
"source": {
"advisory": "GHSA-gg4h-3hg2-grpc",
"discovery": "UNKNOWN"
},
"title": "joi: object().rename() with a template target can set the validated object\u0027s prototype"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84367",
"datePublished": "2026-09-01T20:33:29.295Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-01T20:33:29.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48049 (GCVE-0-2026-48049)
Vulnerability from nvd – Published: 2026-07-17 21:03 – Updated: 2026-07-21 02:26
VLAI
EPSS
VEX
Title
@hapi/inert: Static-file confinement bypass via sibling-prefix path
Summary
@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:25 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/inert/security/advisori… | x_refsource_CONFIRM |
| https://github.com/hapijs/inert/pull/176 | x_refsource_MISC |
| https://github.com/hapijs/inert/commit/bcceb761a4… | x_refsource_MISC |
| https://github.com/hapijs/inert/releases/tag/v7.1.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48049",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:25:52.865059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:26:04.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "inert",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 7.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T21:03:16.577Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g"
},
{
"name": "https://github.com/hapijs/inert/pull/176",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/inert/pull/176"
},
{
"name": "https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9"
},
{
"name": "https://github.com/hapijs/inert/releases/tag/v7.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/inert/releases/tag/v7.1.1"
}
],
"source": {
"advisory": "GHSA-rcvq-m9j9-6f4g",
"discovery": "UNKNOWN"
},
"title": "@hapi/inert: Static-file confinement bypass via sibling-prefix path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48049",
"datePublished": "2026-07-17T21:03:16.577Z",
"dateReserved": "2026-05-20T18:15:53.578Z",
"dateUpdated": "2026-07-21T02:26:04.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48022 (GCVE-0-2026-48022)
Vulnerability from nvd – Published: 2026-07-17 21:02 – Updated: 2026-07-20 19:10
VLAI
EPSS
VEX
Title
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
Summary
@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 18:51 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/wreck/security/advisori… | x_refsource_CONFIRM |
| https://github.com/hapijs/wreck/pull/313 | x_refsource_MISC |
| https://github.com/hapijs/wreck/commit/b93323b63a… | x_refsource_MISC |
| https://github.com/hapijs/wreck/releases/tag/v18.1.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48022",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T18:51:51.976139Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:10:59.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wreck",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 18.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319: Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T21:02:05.980Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc"
},
{
"name": "https://github.com/hapijs/wreck/pull/313",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/pull/313"
},
{
"name": "https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e"
},
{
"name": "https://github.com/hapijs/wreck/releases/tag/v18.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/releases/tag/v18.1.2"
}
],
"source": {
"advisory": "GHSA-x426-x7cc-3fpc",
"discovery": "UNKNOWN"
},
"title": "@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48022",
"datePublished": "2026-07-17T21:02:05.980Z",
"dateReserved": "2026-05-20T17:44:09.587Z",
"dateUpdated": "2026-07-20T19:10:59.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44979 (GCVE-0-2026-44979)
Vulnerability from nvd – Published: 2026-07-17 21:01 – Updated: 2026-07-20 14:35
VLAI
EPSS
VEX
Title
@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects
Summary
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 14:35 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/wreck/security/advisori… | x_refsource_CONFIRM |
| https://github.com/hapijs/wreck/pull/312 | x_refsource_MISC |
| https://github.com/hapijs/wreck/commit/a5b6fac9c6… | x_refsource_MISC |
| https://github.com/hapijs/wreck/releases/tag/v18.1.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44979",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T14:35:37.787374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T14:35:45.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wreck",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 18.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T21:01:01.165Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/wreck/security/advisories/GHSA-vhjm-w67q-g75c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/wreck/security/advisories/GHSA-vhjm-w67q-g75c"
},
{
"name": "https://github.com/hapijs/wreck/pull/312",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/pull/312"
},
{
"name": "https://github.com/hapijs/wreck/commit/a5b6fac9c684621c1d5733d10a0257697cfea373",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/commit/a5b6fac9c684621c1d5733d10a0257697cfea373"
},
{
"name": "https://github.com/hapijs/wreck/releases/tag/v18.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/releases/tag/v18.1.1"
}
],
"source": {
"advisory": "GHSA-vhjm-w67q-g75c",
"discovery": "UNKNOWN"
},
"title": "@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44979",
"datePublished": "2026-07-17T21:01:01.165Z",
"dateReserved": "2026-05-08T16:23:33.264Z",
"dateUpdated": "2026-07-20T14:35:45.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44974 (GCVE-0-2026-44974)
Vulnerability from nvd – Published: 2026-07-17 20:11 – Updated: 2026-07-21 02:16
VLAI
EPSS
VEX
Title
Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters
Summary
@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:14 UTC
CWE
- CWE-436 - Interpretation Conflict
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/content/security/adviso… | x_refsource_CONFIRM |
| https://github.com/hapijs/content/commit/38500795… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44974",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:14:35.542197Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:16:04.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "content",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"; filename=\"shell.php\". This issue is fixed in version 6.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:11:44.250Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8"
},
{
"name": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f"
}
],
"source": {
"advisory": "GHSA-36hh-x5p5-jgc8",
"discovery": "UNKNOWN"
},
"title": "Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44974",
"datePublished": "2026-07-17T20:11:44.250Z",
"dateReserved": "2026-05-08T16:23:33.263Z",
"dateUpdated": "2026-07-21T02:16:04.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48038 (GCVE-0-2026-48038)
Vulnerability from nvd – Published: 2026-07-14 19:24 – Updated: 2026-07-15 13:27
VLAI
EPSS
VEX
Title
joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
Summary
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 13:23 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3113 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/97bd51de94d5… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/fc146a628ab9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:23:16.760424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:27:13.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 17.13.4"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:24:32.644Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79"
},
{
"name": "https://github.com/hapijs/joi/pull/3113",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3113"
},
{
"name": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74"
},
{
"name": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7"
}
],
"source": {
"advisory": "GHSA-q7cg-457f-vx79",
"discovery": "UNKNOWN"
},
"title": "joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48038",
"datePublished": "2026-07-14T19:24:32.644Z",
"dateReserved": "2026-05-20T18:15:53.577Z",
"dateUpdated": "2026-07-15T13:27:13.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35213 (GCVE-0-2026-35213)
Vulnerability from nvd – Published: 2026-04-06 20:08 – Updated: 2026-06-23 15:51
VLAI
EPSS
VEX
Title
Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
Summary
@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 14:01 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/content/security/adviso… | x_refsource_CONFIRM |
| https://github.com/hapijs/content/pull/38 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T14:01:56.331650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T15:51:14.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "content",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T20:08:54.811Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p"
},
{
"name": "https://github.com/hapijs/content/pull/38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/content/pull/38"
}
],
"source": {
"advisory": "GHSA-jg4p-7fhp-p32p",
"discovery": "UNKNOWN"
},
"title": "Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35213",
"datePublished": "2026-04-06T20:08:54.811Z",
"dateReserved": "2026-04-01T18:48:58.937Z",
"dateUpdated": "2026-06-23T15:51:14.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-25166 (GCVE-0-2023-25166)
Vulnerability from nvd – Published: 2023-02-08 19:28 – Updated: 2025-03-10 21:14
VLAI
EPSS
VEX
Title
Regular Expression Denial of Service (ReDoS) Vulnerability
Summary
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 20:58 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/formula/security/adviso… | x_refsource_CONFIRM |
| https://github.com/hapijs/formula/commit/9fbc20a0… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:18:35.265Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg"
},
{
"name": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25166",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T20:58:12.667100Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T21:14:39.268Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "formula",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula\u0027s parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-08T19:28:29.314Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg"
},
{
"name": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe"
}
],
"source": {
"advisory": "GHSA-c2jc-4fpr-4vhg",
"discovery": "UNKNOWN"
},
"title": "Regular Expression Denial of Service (ReDoS) Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-25166",
"datePublished": "2023-02-08T19:28:29.314Z",
"dateReserved": "2023-02-03T16:59:18.246Z",
"dateUpdated": "2025-03-10T21:14:39.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-36604 (GCVE-0-2020-36604)
Vulnerability from nvd – Published: 2022-09-23 05:28 – Updated: 2025-05-27 14:48
VLAI
EPSS
VEX
Summary
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-27 14:47 UTC
CWE
- n/a
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/hoek/issues/352 | x_refsource_MISC |
| https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-54… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:30:08.460Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hoek/issues/352"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2020-36604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-27T14:47:45.364912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-27T14:48:14.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-23T05:28:11.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hoek/issues/352"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36604",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/hapijs/hoek/issues/352",
"refsource": "MISC",
"url": "https://github.com/hapijs/hoek/issues/352"
},
{
"name": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452)",
"refsource": "MISC",
"url": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452)"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36604",
"datePublished": "2022-09-23T05:28:11.000Z",
"dateReserved": "2022-09-23T00:00:00.000Z",
"dateUpdated": "2025-05-27T14:48:14.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-16025 (GCVE-0-2017-16025)
Vulnerability from nvd – Published: 2018-06-04 19:00 – Updated: 2024-09-17 01:12
VLAI
EPSS
VEX
Summary
Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://nodesecurity.io/advisories/331 | x_refsource_MISC |
| https://github.com/hapijs/nes/issues/171 | x_refsource_MISC |
| https://github.com/hapijs/nes/commit/249ba1755ed6… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | nes node module |
Affected:
<=6.4.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:13:06.662Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/331"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/nes/issues/171"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "nes node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c=6.4.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-04T18:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/331"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/nes/issues/171"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2017-16025",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "nes node module",
"version": {
"version_data": [
{
"version_value": "\u003c=6.4.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nodesecurity.io/advisories/331",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/331"
},
{
"name": "https://github.com/hapijs/nes/issues/171",
"refsource": "MISC",
"url": "https://github.com/hapijs/nes/issues/171"
},
{
"name": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655",
"refsource": "MISC",
"url": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2017-16025",
"datePublished": "2018-06-04T19:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:12:03.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-16013 (GCVE-0-2017-16013)
Vulnerability from nvd – Published: 2018-06-04 19:00 – Updated: 2024-09-17 04:09
VLAI
EPSS
VEX
Summary
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodesecurity.io/advisories/335 | x_refsource_MISC |
| https://github.com/hapijs/hapi/issues/3466 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
>= 15.0.0 <= 16.1.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:13:06.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/335"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/3466"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003e= 15.0.0 \u003c= 16.1.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "hapi is a web and services application framework. When hapi \u003e= 15.0.0 \u003c= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-04T18:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/335"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/3466"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2017-16013",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003e= 15.0.0 \u003c= 16.1.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "hapi is a web and services application framework. When hapi \u003e= 15.0.0 \u003c= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nodesecurity.io/advisories/335",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/335"
},
{
"name": "https://github.com/hapijs/hapi/issues/3466",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/3466"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2017-16013",
"datePublished": "2018-06-04T19:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:09:41.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9236 (GCVE-0-2015-9236)
Vulnerability from nvd – Published: 2018-05-31 20:00 – Updated: 2024-09-17 04:15
VLAI
EPSS
VEX
Summary
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
Severity
No CVSS data available.
CWE
- CWE-284 - Improper Access Control - Generic (CWE-284)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/hapi/issues/2850 | x_refsource_MISC |
| https://github.com/hapijs/hapi/issues/2840 | x_refsource_MISC |
| https://nodesecurity.io/advisories/45 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
<11.0.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/2850"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/2840"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/45"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c11.0.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control - Generic (CWE-284)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-31T19:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/2850"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/2840"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/45"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9236",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003c11.0.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Access Control - Generic (CWE-284)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/hapijs/hapi/issues/2850",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/2850"
},
{
"name": "https://github.com/hapijs/hapi/issues/2840",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/2840"
},
{
"name": "https://nodesecurity.io/advisories/45",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/45"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9236",
"datePublished": "2018-05-31T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:15:13.448Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9243 (GCVE-0-2015-9243)
Vulnerability from nvd – Published: 2018-05-29 20:00 – Updated: 2024-09-17 02:27
VLAI
EPSS
VEX
Summary
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Severity
No CVSS data available.
CWE
- CWE-284 - Improper Access Control - Generic (CWE-284)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/hapi/issues/2980 | x_refsource_MISC |
| https://nodesecurity.io/advisories/65 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
<11.1.4
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.327Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/2980"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/65"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c11.1.4"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control - Generic (CWE-284)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-29T19:57:02.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/2980"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/65"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9243",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003c11.1.4"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Access Control - Generic (CWE-284)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/hapijs/hapi/issues/2980",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/2980"
},
{
"name": "https://nodesecurity.io/advisories/65",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/65"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9243",
"datePublished": "2018-05-29T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:27:19.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9241 (GCVE-0-2015-9241)
Vulnerability from nvd – Published: 2018-05-29 20:00 – Updated: 2024-09-16 17:03
VLAI
EPSS
VEX
Summary
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jfhbrook/node-ecstatic/pull/179 | x_refsource_MISC |
| https://github.com/hapijs/hapi/commit/aab2496e930… | x_refsource_MISC |
| https://nodesecurity.io/advisories/63 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
<11.1.3
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:41.875Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/63"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c11.1.3"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain input passed into the If-Modified-Since or Last-Modified headers will cause an \u0027illegal access\u0027 exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-29T19:57:02.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/63"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003c11.1.3"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain input passed into the If-Modified-Since or Last-Modified headers will cause an \u0027illegal access\u0027 exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jfhbrook/node-ecstatic/pull/179",
"refsource": "MISC",
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"name": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"name": "https://nodesecurity.io/advisories/63",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/63"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9241",
"datePublished": "2018-05-29T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:03:05.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-84368 (GCVE-0-2026-84368)
Vulnerability from cvelistv5 – Published: 2026-09-01 20:36 – Updated: 2026-09-02 12:18
VLAI
EPSS
VEX
Title
joi: Prototype pollution via a `__proto__` language key in custom messages
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 12:11 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3138 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3139 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/8d0b808f3e87… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/90d07571923c… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T12:11:08.547444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:18:07.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c= 17.1.1"
},
{
"status": "affected",
"version": "\u003e= 17.2.0, \u003c 17.13.6"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function\u0027s static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:36:51.859Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"
},
{
"name": "https://github.com/hapijs/joi/pull/3138",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3138"
},
{
"name": "https://github.com/hapijs/joi/pull/3139",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3139"
},
{
"name": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"
},
{
"name": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"
}
],
"source": {
"advisory": "GHSA-6w3j-5fw6-r9vr",
"discovery": "UNKNOWN"
},
"title": "joi: Prototype pollution via a `__proto__` language key in custom messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84368",
"datePublished": "2026-09-01T20:36:51.859Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-02T12:18:07.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84367 (GCVE-0-2026-84367)
Vulnerability from cvelistv5 – Published: 2026-09-01 20:33 – Updated: 2026-09-01 20:33
VLAI
EPSS
VEX
Title
joi: object().rename() with a template target can set the validated object's prototype
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Severity
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3134 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3135 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/162f367aa178… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/172ececa192f… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 17.13.5"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi\u0027s lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern\u0027s own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:33:29.295Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"
},
{
"name": "https://github.com/hapijs/joi/pull/3134",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3134"
},
{
"name": "https://github.com/hapijs/joi/pull/3135",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3135"
},
{
"name": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"
},
{
"name": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"
}
],
"source": {
"advisory": "GHSA-gg4h-3hg2-grpc",
"discovery": "UNKNOWN"
},
"title": "joi: object().rename() with a template target can set the validated object\u0027s prototype"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84367",
"datePublished": "2026-09-01T20:33:29.295Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-01T20:33:29.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48049 (GCVE-0-2026-48049)
Vulnerability from cvelistv5 – Published: 2026-07-17 21:03 – Updated: 2026-07-21 02:26
VLAI
EPSS
VEX
Title
@hapi/inert: Static-file confinement bypass via sibling-prefix path
Summary
@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:25 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/inert/security/advisori… | x_refsource_CONFIRM |
| https://github.com/hapijs/inert/pull/176 | x_refsource_MISC |
| https://github.com/hapijs/inert/commit/bcceb761a4… | x_refsource_MISC |
| https://github.com/hapijs/inert/releases/tag/v7.1.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48049",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:25:52.865059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:26:04.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "inert",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 7.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T21:03:16.577Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g"
},
{
"name": "https://github.com/hapijs/inert/pull/176",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/inert/pull/176"
},
{
"name": "https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9"
},
{
"name": "https://github.com/hapijs/inert/releases/tag/v7.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/inert/releases/tag/v7.1.1"
}
],
"source": {
"advisory": "GHSA-rcvq-m9j9-6f4g",
"discovery": "UNKNOWN"
},
"title": "@hapi/inert: Static-file confinement bypass via sibling-prefix path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48049",
"datePublished": "2026-07-17T21:03:16.577Z",
"dateReserved": "2026-05-20T18:15:53.578Z",
"dateUpdated": "2026-07-21T02:26:04.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48022 (GCVE-0-2026-48022)
Vulnerability from cvelistv5 – Published: 2026-07-17 21:02 – Updated: 2026-07-20 19:10
VLAI
EPSS
VEX
Title
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
Summary
@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 18:51 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/wreck/security/advisori… | x_refsource_CONFIRM |
| https://github.com/hapijs/wreck/pull/313 | x_refsource_MISC |
| https://github.com/hapijs/wreck/commit/b93323b63a… | x_refsource_MISC |
| https://github.com/hapijs/wreck/releases/tag/v18.1.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48022",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T18:51:51.976139Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:10:59.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wreck",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 18.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319: Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T21:02:05.980Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc"
},
{
"name": "https://github.com/hapijs/wreck/pull/313",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/pull/313"
},
{
"name": "https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e"
},
{
"name": "https://github.com/hapijs/wreck/releases/tag/v18.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/releases/tag/v18.1.2"
}
],
"source": {
"advisory": "GHSA-x426-x7cc-3fpc",
"discovery": "UNKNOWN"
},
"title": "@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48022",
"datePublished": "2026-07-17T21:02:05.980Z",
"dateReserved": "2026-05-20T17:44:09.587Z",
"dateUpdated": "2026-07-20T19:10:59.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44979 (GCVE-0-2026-44979)
Vulnerability from cvelistv5 – Published: 2026-07-17 21:01 – Updated: 2026-07-20 14:35
VLAI
EPSS
VEX
Title
@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects
Summary
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 14:35 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/wreck/security/advisori… | x_refsource_CONFIRM |
| https://github.com/hapijs/wreck/pull/312 | x_refsource_MISC |
| https://github.com/hapijs/wreck/commit/a5b6fac9c6… | x_refsource_MISC |
| https://github.com/hapijs/wreck/releases/tag/v18.1.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44979",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T14:35:37.787374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T14:35:45.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wreck",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 18.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T21:01:01.165Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/wreck/security/advisories/GHSA-vhjm-w67q-g75c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/wreck/security/advisories/GHSA-vhjm-w67q-g75c"
},
{
"name": "https://github.com/hapijs/wreck/pull/312",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/pull/312"
},
{
"name": "https://github.com/hapijs/wreck/commit/a5b6fac9c684621c1d5733d10a0257697cfea373",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/commit/a5b6fac9c684621c1d5733d10a0257697cfea373"
},
{
"name": "https://github.com/hapijs/wreck/releases/tag/v18.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/wreck/releases/tag/v18.1.1"
}
],
"source": {
"advisory": "GHSA-vhjm-w67q-g75c",
"discovery": "UNKNOWN"
},
"title": "@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44979",
"datePublished": "2026-07-17T21:01:01.165Z",
"dateReserved": "2026-05-08T16:23:33.264Z",
"dateUpdated": "2026-07-20T14:35:45.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44974 (GCVE-0-2026-44974)
Vulnerability from cvelistv5 – Published: 2026-07-17 20:11 – Updated: 2026-07-21 02:16
VLAI
EPSS
VEX
Title
Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters
Summary
@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:14 UTC
CWE
- CWE-436 - Interpretation Conflict
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/content/security/adviso… | x_refsource_CONFIRM |
| https://github.com/hapijs/content/commit/38500795… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44974",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:14:35.542197Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:16:04.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "content",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"; filename=\"shell.php\". This issue is fixed in version 6.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:11:44.250Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8"
},
{
"name": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f"
}
],
"source": {
"advisory": "GHSA-36hh-x5p5-jgc8",
"discovery": "UNKNOWN"
},
"title": "Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44974",
"datePublished": "2026-07-17T20:11:44.250Z",
"dateReserved": "2026-05-08T16:23:33.263Z",
"dateUpdated": "2026-07-21T02:16:04.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48038 (GCVE-0-2026-48038)
Vulnerability from cvelistv5 – Published: 2026-07-14 19:24 – Updated: 2026-07-15 13:27
VLAI
EPSS
VEX
Title
joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
Summary
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 13:23 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3113 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/97bd51de94d5… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/fc146a628ab9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:23:16.760424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:27:13.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 17.13.4"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:24:32.644Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79"
},
{
"name": "https://github.com/hapijs/joi/pull/3113",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3113"
},
{
"name": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74"
},
{
"name": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7"
}
],
"source": {
"advisory": "GHSA-q7cg-457f-vx79",
"discovery": "UNKNOWN"
},
"title": "joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48038",
"datePublished": "2026-07-14T19:24:32.644Z",
"dateReserved": "2026-05-20T18:15:53.577Z",
"dateUpdated": "2026-07-15T13:27:13.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35213 (GCVE-0-2026-35213)
Vulnerability from cvelistv5 – Published: 2026-04-06 20:08 – Updated: 2026-06-23 15:51
VLAI
EPSS
VEX
Title
Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
Summary
@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 14:01 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/content/security/adviso… | x_refsource_CONFIRM |
| https://github.com/hapijs/content/pull/38 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T14:01:56.331650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T15:51:14.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "content",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T20:08:54.811Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p"
},
{
"name": "https://github.com/hapijs/content/pull/38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/content/pull/38"
}
],
"source": {
"advisory": "GHSA-jg4p-7fhp-p32p",
"discovery": "UNKNOWN"
},
"title": "Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35213",
"datePublished": "2026-04-06T20:08:54.811Z",
"dateReserved": "2026-04-01T18:48:58.937Z",
"dateUpdated": "2026-06-23T15:51:14.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-25166 (GCVE-0-2023-25166)
Vulnerability from cvelistv5 – Published: 2023-02-08 19:28 – Updated: 2025-03-10 21:14
VLAI
EPSS
VEX
Title
Regular Expression Denial of Service (ReDoS) Vulnerability
Summary
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 20:58 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/formula/security/adviso… | x_refsource_CONFIRM |
| https://github.com/hapijs/formula/commit/9fbc20a0… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:18:35.265Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg"
},
{
"name": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25166",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T20:58:12.667100Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T21:14:39.268Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "formula",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula\u0027s parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-08T19:28:29.314Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg"
},
{
"name": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe"
}
],
"source": {
"advisory": "GHSA-c2jc-4fpr-4vhg",
"discovery": "UNKNOWN"
},
"title": "Regular Expression Denial of Service (ReDoS) Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-25166",
"datePublished": "2023-02-08T19:28:29.314Z",
"dateReserved": "2023-02-03T16:59:18.246Z",
"dateUpdated": "2025-03-10T21:14:39.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-36604 (GCVE-0-2020-36604)
Vulnerability from cvelistv5 – Published: 2022-09-23 05:28 – Updated: 2025-05-27 14:48
VLAI
EPSS
VEX
Summary
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-27 14:47 UTC
CWE
- n/a
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/hoek/issues/352 | x_refsource_MISC |
| https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-54… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:30:08.460Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hoek/issues/352"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2020-36604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-27T14:47:45.364912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-27T14:48:14.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-23T05:28:11.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hoek/issues/352"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36604",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/hapijs/hoek/issues/352",
"refsource": "MISC",
"url": "https://github.com/hapijs/hoek/issues/352"
},
{
"name": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452)",
"refsource": "MISC",
"url": "https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452)"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36604",
"datePublished": "2022-09-23T05:28:11.000Z",
"dateReserved": "2022-09-23T00:00:00.000Z",
"dateUpdated": "2025-05-27T14:48:14.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-16025 (GCVE-0-2017-16025)
Vulnerability from cvelistv5 – Published: 2018-06-04 19:00 – Updated: 2024-09-17 01:12
VLAI
EPSS
VEX
Summary
Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://nodesecurity.io/advisories/331 | x_refsource_MISC |
| https://github.com/hapijs/nes/issues/171 | x_refsource_MISC |
| https://github.com/hapijs/nes/commit/249ba1755ed6… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | nes node module |
Affected:
<=6.4.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:13:06.662Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/331"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/nes/issues/171"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "nes node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c=6.4.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-04T18:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/331"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/nes/issues/171"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2017-16025",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "nes node module",
"version": {
"version_data": [
{
"version_value": "\u003c=6.4.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nodesecurity.io/advisories/331",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/331"
},
{
"name": "https://github.com/hapijs/nes/issues/171",
"refsource": "MISC",
"url": "https://github.com/hapijs/nes/issues/171"
},
{
"name": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655",
"refsource": "MISC",
"url": "https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2017-16025",
"datePublished": "2018-06-04T19:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:12:03.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-16013 (GCVE-0-2017-16013)
Vulnerability from cvelistv5 – Published: 2018-06-04 19:00 – Updated: 2024-09-17 04:09
VLAI
EPSS
VEX
Summary
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodesecurity.io/advisories/335 | x_refsource_MISC |
| https://github.com/hapijs/hapi/issues/3466 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
>= 15.0.0 <= 16.1.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:13:06.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/335"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/3466"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003e= 15.0.0 \u003c= 16.1.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "hapi is a web and services application framework. When hapi \u003e= 15.0.0 \u003c= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-04T18:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/335"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/3466"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2017-16013",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003e= 15.0.0 \u003c= 16.1.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "hapi is a web and services application framework. When hapi \u003e= 15.0.0 \u003c= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nodesecurity.io/advisories/335",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/335"
},
{
"name": "https://github.com/hapijs/hapi/issues/3466",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/3466"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2017-16013",
"datePublished": "2018-06-04T19:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:09:41.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9236 (GCVE-0-2015-9236)
Vulnerability from cvelistv5 – Published: 2018-05-31 20:00 – Updated: 2024-09-17 04:15
VLAI
EPSS
VEX
Summary
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
Severity
No CVSS data available.
CWE
- CWE-284 - Improper Access Control - Generic (CWE-284)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/hapi/issues/2850 | x_refsource_MISC |
| https://github.com/hapijs/hapi/issues/2840 | x_refsource_MISC |
| https://nodesecurity.io/advisories/45 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
<11.0.0
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/2850"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/2840"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/45"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c11.0.0"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control - Generic (CWE-284)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-31T19:57:01.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/2850"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/2840"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/45"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9236",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003c11.0.0"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Access Control - Generic (CWE-284)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/hapijs/hapi/issues/2850",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/2850"
},
{
"name": "https://github.com/hapijs/hapi/issues/2840",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/2840"
},
{
"name": "https://nodesecurity.io/advisories/45",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/45"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9236",
"datePublished": "2018-05-31T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:15:13.448Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9243 (GCVE-0-2015-9243)
Vulnerability from cvelistv5 – Published: 2018-05-29 20:00 – Updated: 2024-09-17 02:27
VLAI
EPSS
VEX
Summary
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Severity
No CVSS data available.
CWE
- CWE-284 - Improper Access Control - Generic (CWE-284)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/hapi/issues/2980 | x_refsource_MISC |
| https://nodesecurity.io/advisories/65 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
<11.1.4
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.327Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/issues/2980"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/65"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c11.1.4"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control - Generic (CWE-284)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-29T19:57:02.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/issues/2980"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/65"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9243",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003c11.1.4"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Access Control - Generic (CWE-284)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/hapijs/hapi/issues/2980",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/issues/2980"
},
{
"name": "https://nodesecurity.io/advisories/65",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/65"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9243",
"datePublished": "2018-05-29T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:27:19.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9241 (GCVE-0-2015-9241)
Vulnerability from cvelistv5 – Published: 2018-05-29 20:00 – Updated: 2024-09-16 17:03
VLAI
EPSS
VEX
Summary
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Severity
No CVSS data available.
CWE
- CWE-400 - Denial of Service (CWE-400)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jfhbrook/node-ecstatic/pull/179 | x_refsource_MISC |
| https://github.com/hapijs/hapi/commit/aab2496e930… | x_refsource_MISC |
| https://nodesecurity.io/advisories/63 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackerOne | hapi node module |
Affected:
<11.1.3
|
Date Public
2018-04-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:41.875Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nodesecurity.io/advisories/63"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hapi node module",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "\u003c11.1.3"
}
]
}
],
"datePublic": "2018-04-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain input passed into the If-Modified-Since or Last-Modified headers will cause an \u0027illegal access\u0027 exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-29T19:57:02.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nodesecurity.io/advisories/63"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"DATE_PUBLIC": "2018-04-26T00:00:00",
"ID": "CVE-2015-9241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hapi node module",
"version": {
"version_data": [
{
"version_value": "\u003c11.1.3"
}
]
}
}
]
},
"vendor_name": "HackerOne"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain input passed into the If-Modified-Since or Last-Modified headers will cause an \u0027illegal access\u0027 exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jfhbrook/node-ecstatic/pull/179",
"refsource": "MISC",
"url": "https://github.com/jfhbrook/node-ecstatic/pull/179"
},
{
"name": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580",
"refsource": "MISC",
"url": "https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580"
},
{
"name": "https://nodesecurity.io/advisories/63",
"refsource": "MISC",
"url": "https://nodesecurity.io/advisories/63"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2015-9241",
"datePublished": "2018-05-29T20:00:00.000Z",
"dateReserved": "2017-10-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:03:05.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}