GHSA-4RGJ-8MQ3-HGGJ Denial of Service in @hapi/subtext

Versions of @hapi/subtext prior to 6.1.2 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust...

Denial of Service in @commercial/hapi

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist,...

GHSA-66MV-XH68-H6V2 Denial of Service in @commercial/hapi

Affected versions of @commercial/hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist,...

@mojaloop/central-services-health (=9.1.0) potentially affected by unknown CVE via @hapi/hapi (=19.1.0)

@hapi/hapi NPM version =19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hapi and may be impacted: - @mojaloop/central-services-health =9.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-23VW-MHV5-GRV5...

3nit-utils (=0.24.0), @cloudinary/mediaflows-cli (>=0.0.23-beta <=0.0.28) +40 more potentially affected by unknown CVE via @hapi/hapi (>=17.9.0 <=18.4.0)

@hapi/hapi NPM version =17.9.0, =0.0.23-beta, =0.4.0, =7.4.0, =7.0.0, =8.5.0, =0.1.0, =0.7.0, =2.12.6, =1.8.0, =1.8.0, =3.1.0, =3.2.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-23VW-MHV5-GRV5...

Denial of Service in @hapi/hapi

Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will...

GHSA-23VW-MHV5-GRV5 Denial of Service in @hapi/hapi

Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will...

Denial of Service in hapi

All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker...

3nit-components (>=0.0.2 <=0.0.4), 3nit-utils (>=0.3.0 <=0.23.0) +1618 more potentially affected by unknown CVE via hapi (>=0.14.2 <=9.5.1)

hapi NPM version =0.14.2, =0.0.2, =0.3.0, =1.0.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =0.0.1, =0.1.0, =0.9.0, =1.0.7, =0.0.1, =1.0.8, =11.1.27-alpha.4606607431 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7HX8-2RXV-66XV...

GHSA-7HX8-2RXV-66XV Denial of Service in hapi

All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker...

3id-test-helper (>=1.0.0 <=1.0.4), 3nit-utils (>=0.24.0 <=0.30.0) +290 more potentially affected by unknown CVE via @hapi/pez (=4.1.2)

@hapi/pez NPM version =4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/pez and may be impacted: - 3id-test-helper =1.0.0, =0.24.0, =6.8.2, =1.4.0, =0.1.0, =2.1.0, =2.5.0-next.11, =2.6.0, =2.1.0, =2.4.0, =2.1.0, =2.1.0, =2.4.0, =2.7.26 and...

GHSA-G9CG-H3JM-CWRC Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

Prototype Pollution in @hapi/subtext

Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

GHSA-G64Q-3VG8-8F93 Prototype Pollution in pez

All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If...

Prototype Pollution in pez

All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If...

Denial of Service in content

Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expected application...

GHSA-5854-JVXX-2CG9 Denial of Service in content

Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expected application...

3id-test-helper (>=1.0.0 <=1.0.4), 3nit-utils (>=0.24.0 <=0.30.0) +294 more potentially affected by unknown CVE via @hapi/content (=4.1.1)

@hapi/content NPM version =4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/content and may be impacted: - 3id-test-helper =1.0.0, =0.24.0, =6.8.2, =1.4.0, =0.1.0, =2.1.0, =2.5.0-next.11, =2.6.0, =2.1.0, =2.4.0, =2.1.0, =2.1.0, =2.4.0, =2.7....

Denial of Service in @hapi/content

Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

GHSA-3WQH-H42R-X8FQ Denial of Service in @hapi/content

Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...