GHSA-2GGQ-VFCP-GWHJ Cross-Site Scripting in @hapi/boom

Versions of @hapi/boom prior to 0.3.8 are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.3.8 or later...

Denial Of Service (DoS)

@hapi/hapi is vulnerable to denial of service. The CORS request handler causes the function to throw a system error if the header contains certain invalid values...

GHSA-2MVQ-XP48-4C77 Denial of Service in subtext

All versions of subtext are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources...

Denial of Service in subtext

All versions of subtext are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources...

GHSA-4RGJ-8MQ3-HGGJ Denial of Service in @hapi/subtext

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust...

Denial of Service in @hapi/subtext

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust...

GHSA-66MV-XH68-H6V2 Denial of Service in @commercial/hapi

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist,...

Denial of Service in @commercial/hapi

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist,...

3nit-utils (=0.24.0), @cloudinary/mediaflows-cli (>=0.0.23-beta <=0.0.28) +40 more potentially affected by unknown CVE via @hapi/hapi (>=17.9.0 <=18.4.0)

@hapi/hapi NPM version =17.9.0, =0.0.23-beta, =0.4.0, =7.4.0, =7.0.0, =8.5.0, =0.1.0, =0.7.0, =2.12.6, =1.8.0, =1.8.0, =3.1.0, =3.2.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-23VW-MHV5-GRV5...

@mojaloop/central-services-health (=9.1.0) potentially affected by unknown CVE via @hapi/hapi (=19.1.0)

@hapi/hapi NPM version =19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hapi and may be impacted: - @mojaloop/central-services-health =9.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-23VW-MHV5-GRV5...

GHSA-23VW-MHV5-GRV5 Denial of Service in @hapi/hapi

Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will...

Denial of Service in @hapi/hapi

Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will...

3nit-components (>=0.0.2 <=0.0.4), 3nit-utils (>=0.3.0 <=0.23.0) +1620 more potentially affected by unknown CVE via hapi (>=0.14.2 <=9.5.1)

hapi NPM version =0.14.2, =0.0.2, =0.3.0, =1.0.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =0.0.1, =0.1.0, =0.9.0, =1.0.7, =0.0.1, =1.0.8, =11.1.27-alpha.4606607431 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7HX8-2RXV-66XV...

GHSA-7HX8-2RXV-66XV Denial of Service in hapi

All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker...

Denial of Service in hapi

All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker...

3id-test-helper (>=1.0.0 <=1.0.4), 3nit-utils (>=0.24.0 <=0.30.0) +290 more potentially affected by unknown CVE via @hapi/pez (=4.1.2)

@hapi/pez NPM version =4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/pez and may be impacted: - 3id-test-helper =1.0.0, =0.24.0, =6.8.2, =1.4.0, =0.1.0, =2.1.0, =2.5.0-next.11, =2.6.0, =2.1.0, =2.4.0, =2.1.0, =2.1.0, =2.4.0, =2.7.26 and...

Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

GHSA-G9CG-H3JM-CWRC Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

GHSA-G64Q-3VG8-8F93 Prototype Pollution in pez

All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If...

Prototype Pollution in pez

All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If...