CVE-2015-9241

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out default node timeout is 2...

CVE-2015-9243

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions like origin, a higher level config that included security restrictions like origin would have those restrictions...

CVE-2016-10525

When attempting to allow authentication mode try in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication...

CVE-2016-10525

When attempting to allow authentication mode "try" in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication...

CVE-2015-9241

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out default node timeout is 2...

CVE-2015-9243

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions like origin, a higher level config that included security restrictions like origin would have those restrictions...

CVE-2016-10525

When attempting to allow authentication mode try in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication...

CVE-2015-9241

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out default node timeout is 2...

CVE-2015-9243

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions like origin, a higher level config that included security restrictions like origin would have those restrictions...

CVE-2015-9241

Affected software: hapi node module (Node.js) prior to version 11.1.3. Root cause: certain inputs in If-Modified-Since or Last-Modified headers cause an 'illegal access' exception, leading hapi to keep the socket open instead of returning HTTP 500, effectively a denial of service. Impact: potenti...

CVE-2016-10525

Affects hapi-auth-jwt2 prior to 5.1.2: in try authentication mode, an authentication bypass vulnerability exists, enabling bypass of auth checks. Impact described as complete bypass with high severity; fix is to upgrade to 5.1.2 or later. Documents from GHSA and npm advisory confirm vulnerability...

CVE-2015-9243

CVE-2015-9243 affects the hapi Node.js framework prior to version 11.1.4, where merging server/connection/route-level CORS configurations could cause security restrictions (e.g., origin) to be overridden by less restrictive defaults (origin → *). This confluence creates weaker CORS controls than ...

PT-2018-4554

Name of the Vulnerable Software and Affected Versions hapi versions prior to 11.1.3 Description The issue arises when certain input is passed into the If-Modified-Since or Last-Modified headers, causing an 'illegal access' exception. Instead of returning a HTTP 500 error, the hapi node module wil...

PT-2018-4705

Name of the Vulnerable Software and Affected Versions hapi-auth-jwt2 versions prior to 5.1.2 Description The issue allows for a complete authentication bypass when in the try authentication mode. This means that individuals could bypass the authentication process. Recommendations Update to versio...

PT-2018-4556

Name of the Vulnerable Software and Affected Versions hapi versions prior to 11.1.4 Description The issue arises when server level, connection level, or route level CORS configurations in the hapi node module are combined, and a higher level config includes security restrictions, such as origin. ...

CVE-2015-9241: Uncontrolled Resource Consumption

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out default node timeout is 2...

CVE-2015-9243: Improper Access Control

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions like origin, a higher level config that included security restrictions like origin would have those restrictions...

CVE-2016-10525: Improper Authentication

When attempting to allow authentication mode try in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication...

docpad-plugin-hapi (>=2.0.13, <=2.3.3), hapi-advisories (>=0.0.1, <=0.0.6) +7 more potentially affected by CVE-2014-3742 via hapi (>=2.0.0, <=2.1.2)

hapi NPM version =2.0.0, =2.0.13, =0.0.1, =0.9.2, =0.3.0, =0.14.0, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =1.0.0 Source cves: CVE-2014-3742 Source advisory: OSV:GHSA-CQR7-78PJ-3G7J...

File Descriptor Leak Can Cause DoS Vulnerability in hapi

Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak. When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file...