@bakjs/graphql (>=2.0.0, <=2.2.0), @clevyr/pavo-hapi-graphql (>=0.0.1, <=0.0.5) +14 more potentially affected by unknown CVE via apollo-server-hapi (>=1.2.0, <=1.4.0)

apollo-server-hapi NPM version =1.2.0, =2.0.0, =0.0.1, =0.1.0, =1.0.0, =0.0.51, =3.0.0, =1.0.2, =1.0.1, =0.2.2, =0.2.37 - trailpack-apollo 3.0.0-alpha.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0113...

WS-2020-0037

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist,...

WS-2020-0036

Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will...

3nit-utils (>=0.11.1, <=0.23.0), @applicaster/zapp-pipes-dev-kit (>=1.2.7, <=1.4.7) +285 more potentially affected by unknown CVE via hapi (>=17.0.0, <=17.8.5)

hapi NPM version =17.0.0, =0.11.1, =1.2.7, =0.0.1, =1.2.2-rc.0, =0.1.0, =2.2.0-alpha.6, =0.2.0, =0.1.0, =0.2.0, =0.2.0, =0.1.0, =0.1.1, =1.0.0-next.0, =1.0.0-next.5 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0035...

@mojaloop/central-services-health (9.1.0) potentially affected by unknown CVE via @hapi/hapi (19.1.0)

@hapi/hapi NPM version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hapi and may be impacted: - @mojaloop/central-services-health 9.1.0 Source cves: unknown CVE Source advisory: MEND:WS-2020-0036...

3nit-utils (0.24.0), @cloudinary/mediaflows-cli (>=0.0.23-beta, <=0.0.28) +40 more potentially affected by unknown CVE via @hapi/hapi (>=17.9.0, <=18.4.0)

@hapi/hapi NPM version =17.9.0, =0.0.23-beta, =0.4.0, =7.4.0, =7.0.0, =8.5.0-snapshot, =0.1.0, =0.7.0, =2.12.6, =1.8.0, =1.8.0, =3.1.0, =3.2.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0036...

WS-2020-0035

All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker...

500px-display-simulator (0.0.1-SNAPSHOT), @aaa-backend-stack/graphql-rest-bindings (>=1.16.0, <=1.16.9) +771 more potentially affected by unknown CVE via hapi (>=0.14.2, <=16.7.0)

hapi NPM version =0.14.2, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =0.1.0, =1.2.2, =1.0.8-rc.1, =1.0.0-alpha.1, =4.0.5, =0.6.0, =0.1.1, =0.1.0, =16.1.3 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0035...

WS-2020-0034

Versions of @hapi/subtext prior to 6.1.3 or 7.0.3 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

WS-2020-0032

Versions of subtext =4.1.0 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expected...

WS-2020-0030

Versions of @hapi/subtext prior to 6.1.3 or 7.0.3 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

@commercial/hapi (19.0.2), @hapi/hapi (>=19.0.0, <=19.0.4) +7 more potentially affected by unknown CVE via @hapi/accept (4.0.1)

@hapi/accept NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/accept and may be impacted: - @commercial/hapi 19.0.2 - @hapi/hapi =19.0.0, =0.0.3, =0.27.0, =0.27.0, =0.9.0, =2.0.4, =5.0.2 Source cves: unknown CVE Source advisory:...

WS-2020-0029

Versions of @hapi/accept prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

WS-2020-0028

Versions of @hapi/ammo prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error ...

@commercial/hapi (19.0.2), @hapi/hapi (>=19.0.0, <=19.0.4) potentially affected by unknown CVE via @hapi/ammo (4.0.1)

@hapi/ammo NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/ammo and may be impacted: - @commercial/hapi 19.0.2 - @hapi/hapi =19.0.0, =19.0.4 Source cves: unknown CVE Source advisory: MEND:WS-2020-0028...

WS-2020-0027

Versions of @commercial/ammo prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is...

WS-2020-0026

All versions of ammo are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up t...

WS-2016-0087

Hapi is vulnerable to Cross-site Scripting XSS attacks via code injection due to improperly handled invalid payloads...

butchershop (>=0.0.2, <=0.0.6), flod (>=0.0.7, <=0.0.10) +5 more potentially affected by unknown CVE via hapi (>=0.14.2, <=0.15.9)

hapi NPM version =0.14.2, =0.0.2, =0.0.7, =0.1.0, =0.1.0, =0.0.1, =0.0.7 - strider-sauce-sample 0.0.1 Source cves: unknown CVE Source advisory: MEND:WS-2016-0087...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +3351 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (>=m1, <=3.1.4.release)

org.thymeleaf:thymeleaf MAVEN version =m1, =0.5.0, =1.0.0, =0.9.6, =0.9.6, =1.0.0, =0.0.1, =1.0.0, =1.0, =3.4.0, =8.8.2 and more Source cves: CVE-2026-41901 Source advisory: MEND:CVE-2026-41901...