TI-2015-07622 Aliases CVE-2015-9243 GHSA-j3g2-m5jj-6336

Improper access control in HackerOne hapi node module

LOW 28CWE-284Published 2018-05-29 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).

Why it matters now

EPSS 0.01003 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed hapi node module (HackerOne): 11.1.4hapi (npm): 11.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HackerOne	hapi node module	before 11.1.4	11.1.4	Patch available	CNA
—	hapi (npm)	before 11.1.4	11.1.4	Patch available	GHSA-j3g2-m5jj-6336

hapi node module VendorHackerOne Affected before 11.1.4 Fixed in 11.1.4 Patch available CNA
hapi (npm) Vendor— Affected before 11.1.4 Fixed in 11.1.4 Patch available GHSA-j3g2-m5jj-6336

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hapijs:hapi::::::node.js::*	before 11.1.4	Vulnerable	hapijs

cpe:2.3:a:hapijs:hapi:*:*:*:*:*:node.js:*:* Versions before 11.1.4 Vulnerable ·hapijs

Remediation

Fix · CNA hapi node module (HackerOne) Fixed in 11.1.4
Fix · GHSA-j3g2-m5jj-6336 hapi (npm) Fixed in 11.1.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2015-9243
2026-10-03 Alias added: GHSA-j3g2-m5jj-6336

References

Exploit 1

https://github.com/hapijs/hapi/issues/2980

Advisory 2

Other 1

https://www.npmjs.com/advisories/65

TI-2015-07620 Uncontrolled resource consumption in HackerOne hapi node module CVSS 3.0HIGH 7.5
TI-2017-11738 Uncontrolled resource consumption in HackerOne hapi node module CVSS 3.0HIGH 7.5
TI-2015-07616 Improper access control in HackerOne hapi node module CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences