Priority LOW 28
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0033 · Published 2026-11-04 · Fixed in 17.13.9, 18.3.1 CWE-1321
Priority HIGH 72
@hapi/content provides HTTP Content-* header parsing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00411 · Published 2026-10-29 · Fixed in 6.0.3 CWE-1333
Priority HIGH 72
joi is a schema description language and data validator for JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-10-29 · Partial fix · 18.3.1, 17.13.9 CWE-1333
Priority MEDIUM 44
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00466 · Published 2026-10-23 · Fixed in 6.0.3 CWE-1333
Priority MEDIUM 44
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00582 · Published 2026-09-16 · Partial fix · 17.13.7, 18.2.6 CWE-1333
Priority MEDIUM 61
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00389 · Published 2026-09-13 · Partial fix · 17.13.8, 18.2.9 CWE-1321
Priority LOW 18
joi is a schema description language and data validator for JavaScript.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00389 · Published 2026-09-01 · Partial fix · 17.13.6, 18.2.5 CWE-1321
Priority LOW 18
joi is a schema description language and data validator for JavaScript.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00389 · Published 2026-09-01 · Partial fix · 17.13.5, 18.2.4 CWE-1321
Priority LOW 31
@hapi/inert provides static file and directory handlers for hapi.js.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0059 · Published 2026-07-17 · Fixed in 7.1.1 CWE-22
Priority LOW 28
@hapi/wreck is an HTTP client utility.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00176 · Published 2026-07-17 · Partial fix · 18.1.2 CWE-319
Priority LOW 28
@hapi/wreck is an HTTP client utility.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0042 · Published 2026-07-17 · Partial fix · 18.1.1 CWE-200
Priority MEDIUM 42
@hapi/content provided HTTP Content-* headers parsing.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00472 · Published 2026-07-17 · Fixed in 6.0.2 CWE-436
Priority LOW 31
joi is a schema description language and data validator for JavaScript.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00524 · Published 2026-07-14 · Partial fix · 17.13.4, 18.2.1 CWE-248
Priority MEDIUM 44
@hapi/content provided HTTP Content-* headers parsing.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00328 · Published 2026-04-06 · Fixed in 6.0.1 CWE-1333
Priority LOW 30
formula is a math and string formula parser.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00611 · Published 2023-02-08 · Partial fix · 3.0.1 CWE-1333
Priority MEDIUM 40
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01241 · Published 2022-09-23 · Partial fix · 8.5.1, 9.0.3 CWE-1321
Priority LOW 30
Nes is a websocket extension library for hapi.
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01872 · Published 2018-06-04 · Fixed in 6.4.1 CWE-400
Priority LOW 36
hapi is a web and services application framework.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01559 · Published 2018-06-04 · Fixed in 16.1.1 CWE-400
Priority LOW 27
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01516 · Published 2018-05-31 · Fixed in 11.0.0 CWE-284
Priority LOW 28
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config tha…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01003 · Published 2018-05-29 · Fixed in 11.1.4 CWE-284
Priority LOW 37
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02063 · Published 2018-05-29 · Fixed in 11.1.3 CWE-400
Priority MEDIUM 45
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the pro…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0419 · Published 2018-03-30 · Partial fix · 5.0.3, 4.2.1 CWE-471
THREATIST.IORead the docs