Denial of Service in content

Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expected application...

GHSA-5854-JVXX-2CG9 Denial of Service in content

Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expected application...

Denial of Service in @hapi/content

Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

GHSA-3WQH-H42R-X8FQ Denial of Service in @hapi/content

Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

GHSA-GJPH-XF5Q-6MFQ Denial of Service in @hapi/ammo

Versions of @hapi/ammo prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error ...

@commercial/hapi (19.0.2), @hapi/hapi (>=19.0.0, <=19.0.4) potentially affected by unknown CVE via @hapi/ammo (4.0.1)

@hapi/ammo NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/ammo and may be impacted: - @commercial/hapi 19.0.2 - @hapi/hapi =19.0.0, =19.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-GJPH-XF5Q-6MFQ...

Denial of Service in @hapi/ammo

Versions of @hapi/ammo prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error ...

@commercial/hapi (19.0.2), @hapi/hapi (>=19.0.0, <=19.0.4) +7 more potentially affected by unknown CVE via @hapi/accept (4.0.1)

@hapi/accept NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/accept and may be impacted: - @commercial/hapi 19.0.2 - @hapi/hapi =19.0.0, =0.0.3, =0.27.0, =0.27.0, =0.9.0, =2.0.4, =5.0.2 Source cves: unknown CVE Source advisory:...

GHSA-9VRW-M88G-W75Q Denial of Service in @hapi/accept

Versions of @hapi/accept prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

Denial of Service in @hapi/accept

Versions of @hapi/accept prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

GHSA-MG85-8MV5-FFJR Denial of Service in ammo

All versions of ammo are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up t...

Denial of Service in ammo

All versions of ammo are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up t...

Unsafe Merging of CORS Configuration Conflict in hapi

Versions of hapi prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended. Recommendation Update hapi to version...

be-more-hapi (1.0.0-rc.1.1), kazana-server (3.0.0) +2 more potentially affected by CVE-2015-9243 via hapi (>=11.0.1, <=11.1.2)

hapi NPM version =11.0.1, =0.1.94, =0.1.129 Source cves: CVE-2015-9243 Source advisory: OSV:GHSA-J3G2-M5JJ-6336...

GHSA-J3G2-M5JJ-6336 Unsafe Merging of CORS Configuration Conflict in hapi

Versions of hapi prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended. Recommendation Update hapi to version...

butchershop (0.1.0-pre), grunt-butchershop (0.2.1) +2 more potentially affected by CVE-2014-4671 via hapi (6.0.2)

hapi NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on hapi and may be impacted: - butchershop 0.1.0-pre - grunt-butchershop 0.2.1 - hapi-level =0.0.3, =0.0.7 - rutha-utils 0.1.0 Source cves: CVE-2014-4671 Source advisory:...

GHSA-363H-VJ6Q-3CMJ Rosetta-Flash JSONP Vulnerability in hapi

This description taken from the pull request provided by Patrick Kettner. Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy. Recommendation - Update hapi to version 6.1.1...

Rosetta-Flash JSONP Vulnerability in hapi

This description taken from the pull request provided by Patrick Kettner. Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy. Recommendation - Update hapi to version 6.1.1...

Reflected XSS in GraphQL Playground

Impact directly impacted: - [email protected] - all unsanitized user input for renderPlaygroundPage all of our consuming packages of graphql-playground-html are impacted: - [email protected] - unsanitized user input to expressPlayground -...

Information Exposure

Overview Versions of apollo-server-hapi prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations...