汇总 hapijs 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
已披露问题常与 输入验证问题与路径处理缺陷 相关，可能在 软件部署与生产负载 场景中带来 异常行为与文件覆盖 等暴露风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2020-36604 | hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. | [email protected] | 8.1 | 0.92% | 2022-09-23 | 2026-06-16 |
| CVE-2017-16025 | Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out. | [email protected] | 5.9 | 1.90% | 2018-06-04 | 2026-06-16 |
| CVE-2017-16013 | hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached. | [email protected] | 7.5 | 1.58% | 2018-06-04 | 2026-06-16 |
| CVE-2015-9236 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route. | [email protected] | 5.3 | 1.54% | 2018-05-31 | 2026-06-16 |
| CVE-2015-9243 | When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`). | [email protected] | 5.9 | 1.04% | 2018-05-29 | 2026-06-16 |
| CVE-2015-9241 | Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes). | [email protected] | 7.5 | 2.14% | 2018-05-29 | 2026-06-16 |
| CVE-2018-3728 | hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects. | [email protected] | 8.8 | 4.23% | 2018-03-30 | 2026-06-16 |