PT-2020-20944

Name of the Vulnerable Software and Affected Versions @hapi/hoek versions prior to 8.5.1 @hapi/hoek versions prior to 9.0.3 Description The issue concerns Prototype Pollution due to the clone function in @hapi/hoek failing to prevent the modification of the Object prototype when passed...

Denial of Service in subtext

All versions of subtext are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources...

GHSA-2MVQ-XP48-4C77 Denial of Service in subtext

All versions of subtext are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources...

Denial of Service in @hapi/subtext

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust...

GHSA-4RGJ-8MQ3-HGGJ Denial of Service in @hapi/subtext

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust...

Denial of Service in @commercial/hapi

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist,...

GHSA-66MV-XH68-H6V2 Denial of Service in @commercial/hapi

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist,...

Denial of Service in @hapi/hapi

Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will...

3nit-utils (0.24.0), @cloudinary/mediaflows-cli (>=0.0.23-beta, <=0.0.28) +29 more potentially affected by unknown CVE via @hapi/hapi (>=18.3.1, <=18.4.0)

@hapi/hapi NPM version =18.3.1, =0.0.23-beta, =7.4.0, =7.0.0, =8.5.0-snapshot, =0.1.0, =0.7.0, =2.12.6, =1.8.0, =1.8.0, =0.0.1, =1.0.0, =1.0.0, =2.0.0, =2.0.4 and more Source cves: unknown CVE Source advisory: GHSA-23VW-MHV5-GRV5...

@mojaloop/central-services-health (9.1.0) potentially affected by unknown CVE via @hapi/hapi (19.1.0)

@hapi/hapi NPM version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hapi and may be impacted: - @mojaloop/central-services-health 9.1.0 Source cves: unknown CVE Source advisory: GHSA-23VW-MHV5-GRV5...

GHSA-23VW-MHV5-GRV5 Denial of Service in @hapi/hapi

Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will...

@mojaloop/central-services-health (9.1.0) potentially affected by unknown CVE via @hapi/hapi (19.1.0)

@hapi/hapi NPM version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hapi and may be impacted: - @mojaloop/central-services-health 9.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-23VW-MHV5-GRV5...

3nit-utils (0.24.0), @cloudinary/mediaflows-cli (>=0.0.23-beta, <=0.0.28) +29 more potentially affected by unknown CVE via @hapi/hapi (>=18.3.1, <=18.4.0)

@hapi/hapi NPM version =18.3.1, =0.0.23-beta, =7.4.0, =7.0.0, =8.5.0-snapshot, =0.1.0, =0.7.0, =2.12.6, =1.8.0, =1.8.0, =0.0.1, =1.0.0, =1.0.0, =2.0.0, =2.0.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-23VW-MHV5-GRV5...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=0.23.0) +1617 more potentially affected by unknown CVE via hapi (>=0.14.2, <=18.1.0)

hapi NPM version =0.14.2, =0.0.2, =0.3.0, =1.0.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =0.0.1, =0.1.0, =0.9.0, =1.0.7, =0.0.1, =1.0.8-rc.1, =11.1.27-alpha.4606607431 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7HX8-2RXV-66XV...

GHSA-7HX8-2RXV-66XV Denial of Service in hapi

All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker...

Denial of Service in hapi

All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=0.23.0) +1617 more potentially affected by unknown CVE via hapi (>=0.14.2, <=18.1.0)

hapi NPM version =0.14.2, =0.0.2, =0.3.0, =1.0.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =0.0.1, =0.1.0, =0.9.0, =1.0.7, =0.0.1, =1.0.8-rc.1, =11.1.27-alpha.4606607431 and more Source cves: unknown CVE Source advisory: GHSA-7HX8-2RXV-66XV...

Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

GHSA-G9CG-H3JM-CWRC Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

GHSA-G64Q-3VG8-8F93 Prototype Pollution in pez

All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If...