HA
Vendor
hapijs
21
CVEs
0
On KEV
3
New 30D
Products
JO7.5
joi
hapijs
6 CVEs0 on KEV1 new
CO7.7
content
hapijs
3 CVEs0 on KEV1 new
HA7.5
@hapi/content
hapijs
1 CVEs0 on KEV1 new
HA7.5
Hapi
Hapijs
4 CVEs0 on KEV0 new
HO8.8
Hoek
Hapijs
2 CVEs0 on KEV0 new
WR6.5
wreck
hapijs
2 CVEs0 on KEV0 new
FO6.5
formula
hapijs
1 CVEs0 on KEV0 new
IN5.3
inert
hapijs
1 CVEs0 on KEV0 new
NE5.9
Nes
Hapijs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119202 New | CO content hapijs | 7.5 | Oct 29 | @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service |
| CVE-2026-118772 New | JO joi hapijs | 7.5 | Oct 29 | joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service |
| CVE-2026-115728 New | HA @hapi/content hapijs | 7.5 | Oct 23 | @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing |
| CVE-2026-92599 | JO joi hapijs | 7.5 | Sep 16 | Joi before 17.13.7 and 18.2.6 ReDoS via isoDate |
| CVE-2026-90771 | JO joi hapijs | 3.7 | Sep 13 | joi before 17.13.8 and 18.2.9 Prototype Pollution via messages |
| CVE-2026-84368 | JO joi hapijs | 3.7 | Sep 1 | joi: Prototype pollution via a `__proto__` language key in custom messages |
| CVE-2026-84367 | JO joi hapijs | 3.7 | Sep 1 | joi: object().rename() with a template target can set the validated object's prototype |
| CVE-2026-48049 | IN inert hapijs | 5.3 | Jul 17 | @hapi/inert: Static-file confinement bypass via sibling-prefix path |
| CVE-2026-48022 | WR wreck hapijs | 6.5 | Jul 17 | @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects |
| CVE-2026-44979 | WR wreck hapijs | 6.3 | Jul 17 | @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects |
| CVE-2026-44974 | CO content hapijs | 7.7 | Jul 17 | Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters |
| CVE-2026-48038 | JO joi hapijs | 5.3 | Jul 14 | joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas |
| CVE-2026-35213 | CO content hapijs | 7.5 | Apr 6 | Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing |
| CVE-2023-25166 | FO formula hapijs | 6.5 | Feb 8 | Regular Expression Denial of Service (ReDoS) Vulnerability |
| CVE-2020-36604 | HO Hoek Hapijs | 8.1 | Sep 23 | hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function |
| CVE-2017-16025 | NE Nes Hapijs | 5.9 | Jun 4 | Nes is a websocket extension library for hapi |
| CVE-2017-16013 | HA Hapi Hapijs | 7.5 | Jun 4 | hapi is a web and services application framework |
| CVE-2015-9236 | HA Hapi Hapijs | 5.3 | May 31 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities… |
| CVE-2015-9243 | HA Hapi Hapijs | 5.9 | May 29 | When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions… |
| CVE-2015-9241 | HA Hapi Hapijs | 7.5 | May 29 | Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised |
| CVE-2018-3728 | HO Hoek Hapijs | 8.8 | Mar 30 | hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which… |