HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

MAL-2026-1108 Malicious code in hapi-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90adf52f1b608bcddb8f6471e64ded19817bef1b8aa1715256182f0e7a3ab690 The package hapi-lint was found to contain malicious code. Source: ghsa-malware 388b8a57423bf6789ce0a82c22d6856663fcbc1cd2ff7ce5c6f7ef701567c19e Any...

Malicious code in hapi-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90adf52f1b608bcddb8f6471e64ded19817bef1b8aa1715256182f0e7a3ab690 The package hapi-lint was found to contain malicious code. Source: ghsa-malware 388b8a57423bf6789ce0a82c22d6856663fcbc1cd2ff7ce5c6f7ef701567c19e Any...

Malicious Package

Overview hapi-lint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2019-12741

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

ai.ylyue:yue-library-data-es (>=j8.2.2.0 <=j11.2.6.2), br.com.simpli:simpli-ws (>=1.2.1 <=2.2.0) +1034 more potentially affected by CVE-2025-37731 via org.elasticsearch:elasticsearch (>=7.0.0-alpha1 <=8.19.7)

org.elasticsearch:elasticsearch MAVEN version =7.0.0-alpha1, =j8.2.2.0, =1.2.1, =0.0.1-alpha, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =6.2.0, =6.8.0, =6.4.0, =5.3.0, =5.3.0, =5.3.0, =5.4.0 and more Source cves: CVE-2025-37731 Source advisory: OSV:GHSA-M9GH-789G-Q5PV...

au.csiro.pathling:fhir-server (>=6.2.2 <=7.2.0), br.com.jarch:jarch-apt (>=20.7.0 <=25.12.0) +746 more potentially affected by CVE-2025-66021 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (>=r136 <=20240325.1)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version =r136, =6.2.2, =20.7.0, =24.2.0, =20.7.0, =23.1.0, =24.2.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.6.8 and more Source cves: CVE-2025-66021 Source advisory:...

EUVD-2025-198848

Malicious code in @trigo/hapi-auth-signedlink npm...

Malicious code in @trigo/hapi-auth-signedlink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed6824ae90bafaade2c426612b295defed6107b61296445aa2d1d728729c23b The package @trigo/hapi-auth-signedlink was found to contain malicious code. Source: ghsa-malware...

Prototype Pollution

@hapi/pez is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of multipart payloads, allowing an attacker to craft a part whose content becomes the payload object's prototype, which enables bypassing validation rules or causing exceptions when accessing the request...

EUVD-2025-177342

Malicious code in palynology-cybernetics-schema-hapi npm...

EUVD-2025-178603

Malicious code in hapi-zenobia-ophiuchus-quantum npm...

EUVD-2025-178606

Malicious code in hapi-orogeny-tardigrade-rate-limiter npm...

EUVD-2025-177924

Malicious code in mechatronics-augmentedreality-hapi-jupiter npm...

EUVD-2025-175808

Malicious code in unuk-hapi-cross-env-nashira npm...

Malicious code in hapi-cross-env-subduction-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f40ef79d55d711a81f41e27b0ebbed64b13ba05ad6e7de94c557da9e8c1ea416 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in palynology-cybernetics-schema-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54cb449bb955da5853cbd3c10edec33c18b47b924c86c52bd0f4d8d627cbc741 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...