GitHub Advisoryadvisory · npm

GHSA-j3g2-m5jj-6336 Unsafe Merging of CORS Configuration Conflict in hapi

MEDIUM Published 2020-09-01 Modified 2020-08-31 Official page ↗
Aliases
CVE-2015-9243
Ecosystem
npm
Packages
hapi
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2020-08-31

Affected packages

• npm hapi: < 11.1.4 → fixed in 11.1.4

Description

Versions of `hapi` prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended. Recommendation Update hapi to version 11.1.4 or later.

Related

Alias · CVE (1)

  • CVE-2015-9243 When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References