Hapijs Hapi vulnerabilities

CVE-2014-4671 [MEDIUM] CWE-352 Rosetta-Flash JSONP Vulnerability in hapi Rosetta-Flash JSONP Vulnerability in hapi This description taken from the pull request provided by Patrick Kettner. Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy. ## Recommendation - Update hapi to version 6.1.1 or later. Alternatively, a solution previously implemented by Google, Faceboo

CVE-2015-9241 [HIGH] CWE-400 CVE-2015-9241: Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal acce Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).

CVE-2017-16013 [HIGH] CWE-400 CVE-2017-16013: hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malform hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

CVE-2015-9243 [MEDIUM] CWE-284 CVE-2015-9243: When server level, connection level or route level CORS configurations in hapi node module before 11 When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin def

CVE-2015-9236 [MEDIUM] CWE-284 CVE-2015-9236: Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at bes Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default

CVE-2014-3742 [HIGH] CWE-400 File Descriptor Leak Can Cause DoS Vulnerability in hapi File Descriptor Leak Can Cause DoS Vulnerability in hapi Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak. When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have bee