hapi node module

4 results · Feed

• High 7.5
  CVE-2017-16013

  Denial of Service via malformed accept-encoding header in hapi

  hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

  HackerOne hapi node module hapi npm
  Jun 4, 2018
• Medium —
  CVE-2015-9236

  Incorrect handling of CORS preflight request headers in hapi

  Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one rou…

  HackerOne hapi node module hapi npm
  May 31, 2018
• High —
  CVE-2015-9241

  Denial of Service in hapi

  Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until …

  HackerOne hapi node module hapi npm
  May 29, 2018
• Medium —
  CVE-2015-9243

  Unsafe Merging of CORS Configuration Conflict in hapi

  When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like …

  HackerOne hapi node module hapi npm
  May 29, 2018