ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.79), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.79) +3 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.79)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.79 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.79 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.106), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.106) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.106)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.106 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.106 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.108), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.108) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.108)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.108 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.108 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.12), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.12) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.4.12)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.4.12 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.12 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.37), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.37) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.37)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.37 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.37 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.1.3), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.1.3) +52 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.36)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.36 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (4.1.0) +49 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (4.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +157 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.0.0, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-55470 Source advisory: OSV:GHSA-FXJ4-P9XP-37V5...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT transform helpers. The transform... overloads obtain their TransformerFactory from the project's hardened helper XMLUtil.newXXEProtectedTransformerFactory which sets ACCESSEXTERNALDTD="" and ACCESSEXTERNALSTYLESHEET="". Th...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

GHSA-RCVQ-M9J9-6F4G @hapi/inert has a static-file confinement bypass via sibling-prefix path

Impact @hapi/inert serves static files from a directory configured with path in the directory / file handlers or relativeTo for h.file, with confinement enforced by the confine option default true. Before the patch, the confinement check compared the resolved absolute path against the confine...

Directory Traversal

Overview @hapi/inert is a Static file and directory handlers plugin for hapi.js Affected versions of this package are vulnerable to Directory Traversal via the confine option. An unauthenticated remote attacker can access files outside the intended directory by crafting requests that exploit...

3id-test-helper (>=1.0.0, <=1.0.4), 3nit-utils (>=0.24.0, <=1.0.2) +314 more potentially affected by CVE-2026-48049 via @hapi/inert (>=5.2.0, <=7.1.0)

@hapi/inert NPM version =5.2.0, =1.0.0, =0.24.0, =3.0.0-beta.1, =4.0.0, =0.9.0, =0.1.0, =1.0.1, =0.9.139, =5.0.0-ayFork-1.0.16, =3.0.0, =6.1.0, =0.0.2, =0.11.0, =9.0.0 and more Source cves: CVE-2026-48049 Source advisory: GHSA-RCVQ-M9J9-6F4G...

@iotfactory/poetry (>=0.7.1-alpha.12, <=0.11.3), @mojaloop/als-consent-oracle (>=1.1.0, <=1.1.7) +22 more potentially affected by CVE-2026-48049 via @hapi/inert (>=7.0.0, <=7.1.0)

@hapi/inert NPM version =7.0.0, =0.7.1-alpha.12, =1.1.0, =15.2.0, =17.1.6, =15.2.0-snapshot.0, =0.1.11, =0.9.0, =15.5.0-iso.0, =17.1.0, =2.60.1, =14.1.0, =0.9.0, =2.0.3, =2.2.2 - microkernel-mod-graphqlio 1.9.1 and more Source cves: CVE-2026-48049 Source advisory: SNYK:JS-HAPIINERT-17337031...

@hapi/inert has a static-file confinement bypass via sibling-prefix path

Impact @hapi/inert serves static files from a directory configured with path in the directory / file handlers or relativeTo for h.file, with confinement enforced by the confine option default true. Before the patch, the confinement check compared the resolved absolute path against the confine...

3id-test-helper (>=1.0.0, <=1.0.4), 3nit-utils (>=0.24.0, <=1.0.2) +314 more potentially affected by CVE-2026-48049 via @hapi/inert (>=5.2.0, <=7.1.0)

@hapi/inert NPM version =5.2.0, =1.0.0, =0.24.0, =3.0.0-beta.1, =4.0.0, =0.9.0, =0.1.0, =1.0.1, =0.9.139, =5.0.0-ayFork-1.0.16, =3.0.0, =6.1.0, =0.0.2, =0.11.0, =9.0.0 and more Source cves: CVE-2026-48049 Source advisory: OSV:GHSA-RCVQ-M9J9-6F4G...

@userfront/bell (>=5.2.3-0, <=6.0.0), ffc-auth (>=0.1.0-alpha.1, <=0.13.0-alpha.2) +1 more potentially affected by CVE-2026-48022 via @hapi/wreck (>=18.0.0, <=18.0.1)

@hapi/wreck NPM version =18.0.0, =5.2.3-0, =0.1.0-alpha.1, =1.0.2, =1.0.4 Source cves: CVE-2026-48022 Source advisory: OSV:GHSA-X426-X7CC-3FPC...

@userfront/bell (>=5.2.3-0, <=6.0.0), ffc-auth (>=0.1.0-alpha.1, <=0.13.0-alpha.2) +1 more potentially affected by CVE-2026-48022 via @hapi/wreck (>=18.0.0, <=18.0.1)

@hapi/wreck NPM version =18.0.0, =5.2.3-0, =0.1.0-alpha.1, =1.0.2, =1.0.4 Source cves: CVE-2026-48022 Source advisory: GHSA-X426-X7CC-3FPC...

GHSA-X426-X7CC-3FPC @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

Impact Wreck strips credential headers Authorization, Cookie, Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port. As a result, credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP...