MAL-2025-11934 Malicious code in @zalastax/nolb-hapi-k (npm)

The package @zalastax/nolb-hapi-k was found to contain malicious code...

MAL-2025-34224 Malicious code in supervisor-draco-socketio-hapi (npm)

The package supervisor-draco-socketio-hapi was found to contain malicious code...

MAL-2025-22182 Malicious code in hapi-logstash-tester (npm)

The package hapi-logstash-tester was found to contain malicious code...

MAL-2025-11936 Malicious code in @zalastax/nolb-hapi-m (npm)

The package @zalastax/nolb-hapi-m was found to contain malicious code...

MAL-2025-11930 Malicious code in @zalastax/nolb-hapi-g (npm)

The package @zalastax/nolb-hapi-g was found to contain malicious code...

MAL-2025-26413 Malicious code in mineralogy-hapi-buffer-gulp (npm)

The package mineralogy-hapi-buffer-gulp was found to contain malicious code...

MAL-2025-22181 Malicious code in hapi-kafka-node (npm)

The package hapi-kafka-node was found to contain malicious code...

MAL-2025-11923 Malicious code in @zalastax/nolb-hapi-4 (npm)

The package @zalastax/nolb-hapi-4 was found to contain malicious code...

MAL-2025-34370 Malicious code in tachyon-style-loader-sadr-hapi (npm)

The package tachyon-style-loader-sadr-hapi was found to contain malicious code...

MAL-2025-22187 Malicious code in hapi-services (npm)

The package hapi-services was found to contain malicious code...

MAL-2025-11926 Malicious code in @zalastax/nolb-hapi-c (npm)

The package @zalastax/nolb-hapi-c was found to contain malicious code...

MAL-2025-11924 Malicious code in @zalastax/nolb-hapi-a (npm)

The package @zalastax/nolb-hapi-a was found to contain malicious code...

MAL-2025-15894 Malicious code in blueshift-hapi-blaze-atlas (npm)

The package blueshift-hapi-blaze-atlas was found to contain malicious code...

Denial Of Service (DoS)

@hapi/subtext is vulnerable to Denial Of Service DoS. The vulnerability is due to improper parsing of the Content-Encoding HTTP header, which causes a system error on invalid values and is rethrown up the stack without handling, allowing an attacker to crash the application and shut down services...

graphql-playground

This is a repository for the GraphQL Playground, a development environment for building and testing GraphQL APIs. The repository contains several packages, including GraphQL Playground HTML, GraphQL Playground Express Middleware, GraphQL Playground Koa Middleware, and GraphQL Playground Hapi...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

XML External Entity (XXE) Injection

HAPI FHIR is vulnerable to XML External Entity XXE Injection. The vulnerability is due to insecure XML parsing by HAPI FHIR, specifically within the XSLT parsing components, which improperly handle external entity references in XML files. It allows attackers to inject malicious XML content, such ...

org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR arbitrary code execution via specially-crafted request

A flaw was found in Fast Healthcare Interoperability Resources HAPI FHIR. This vulnerability could allow attackers to execute arbitrary code or access sensitive information via a crafted request which contains malicious XML entities...

XML External Entity (XXE)

hapi fhir is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML input. Specifically, the system fails to properly disable or validate external entities within XML documents, allowing attackers to inject malicious XML that can lead to unauthorized data acce...

CVE-2024-52007

A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...