Design/Logic Flaw

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...

CVE-2017-16013

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...

CVE-2017-16025

Summary : The vulnerability affects the Nes WebSocket extension for hapi. Versions up to and including 6.4.0 are susceptible to a denial-of-service when websocket authentication uses a cookie and an invalid cookie is submitted during the upgrade request, causing the node process to error/terminat...

CVE-2017-16025

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to cookie. Submitting an invalid cookie on the websocket...

CVE-2017-16025

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to cookie. Submitting an invalid cookie on the websocket...

CVE-2017-16013

The CVE-2017-16013 entry concerns the hapi web framework for Node.js. Affected versions are 15.0.0 through 16.1.0, where receiving a malformed accept-encoding header can trigger an uncaught exception, causing the hapi process to crash or the client connection to hang until timeout. This has been ...

CVE-2017-16013

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...

CVE-2017-16013

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed "accept-encoding" header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...

@antodip/tech-utils (>=0.1.0, <=0.1.9), @applicaster/zapp-pipes-dev-kit (>=1.2.2, <=1.2.6) +122 more potentially affected by CVE-2017-16013 via hapi (>=15.0.2, <=16.1.0)

hapi NPM version =15.0.2, =0.1.0, =1.2.2, =1.0.8-rc.1, =1.0.0-alpha.1, =1.1.0, =4.0.0, =1.2.3, =0.1.0, =0.1.0, =0.1.0, =0.9.28, =0.17.44, =1.0.0-quotes.26, =1.0.27, =1.0.29 and more Source cves: CVE-2017-16013 Source advisory: MEND:CVE-2017-16013...

CVE-2017-16025: Uncontrolled Resource Consumption

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to cookie. Submitting an invalid cookie on the websocket...

PT-2018-6043

Name of the Vulnerable Software and Affected Versions: hapi versions 15.0.0 through 16.1.0 Description: The issue occurs when hapi encounters a malformed accept-encoding header, which may cause it to crash or hang the client connection until the timeout period is reached. Affected versions of hap...

CVE-2017-16013: Uncontrolled Resource Consumption

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...

CVE-2016-10543

call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules...

Design/Logic Flaw

call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules...

Design/Logic Flaw

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GE...

CVE-2015-9236

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GE...

@eins78/pixelstatus (>=1.0.0-beta.5, <=1.1.1), @icehunter/hapi-api (1.0.8) +325 more potentially affected by CVE-2015-9236 via hapi (>=0.14.2, <=10.5.0)

hapi NPM version =0.14.2, =1.0.0-beta.5, =1.0.5, =1.0.0-alpha10, =0.1.0, =0.1.2, =0.0.3, =1.0.0, =2.1.0 and more Source cves: CVE-2015-9236 Source advisory: MEND:CVE-2015-9236...

CVE-2016-10543

call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules...

CVE-2015-9236

CVE-2015-9236 concerns Hapi (Node.js framework) versions

CVE-2015-9236

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GE...