Read the docs
TI-2015-07616 Aliases CVE-2015-9236GHSA-vwrf-r5r4-7775

Improper access control in HackerOne hapi node module

Priority LOW 27CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284 and CWE-200.

Summary

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.

Why it matters now

EPSS 0.01516 74th percentileScored 2026-11-07
Fix Fixed hapi node module (HackerOne): 11.0.0hapi (npm): 11.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOnehapi node modulebefore 11.0.011.0.0Patch availableCNA
—hapi (npm)before 11.0.011.0.0Patch availableGHSA-vwrf-r5r4-7775
  • hapi node module VendorHackerOne Affected before 11.0.0 Fixed in 11.0.0 Patch available CNA
  • hapi (npm) Vendor— Affected before 11.0.0 Fixed in 11.0.0 Patch available GHSA-vwrf-r5r4-7775

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hapijs:hapi:*:*:*:*:*:node.js:*:*before 11.0.0Vulnerablehapijs
  • cpe:2.3:a:hapijs:hapi:*:*:*:*:*:node.js:*:* Versions before 11.0.0 Vulnerable ·hapijs

Remediation

  • Fix · CNA hapi node module (HackerOne) Fixed in 11.0.0
  • Fix · GHSA-vwrf-r5r4-7775 hapi (npm) Fixed in 11.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-9236
  2. 2026-10-03 Alias added: GHSA-vwrf-r5r4-7775

References

Patch 1

Advisory 4

Other 1

  • TI-2015-07620 Uncontrolled resource consumption in HackerOne hapi node module CVSS 3.0HIGH 7.5
  • TI-2017-11738 Uncontrolled resource consumption in HackerOne hapi node module CVSS 3.0HIGH 7.5
  • TI-2015-07622 Improper access control in HackerOne hapi node module CVSS 3.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences