Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

hapijs — Vulnerabilities & Security Advisories 15

Browse all 15 CVE security advisories affecting hapijs. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page aggregates common weak enumerations, classifications, and mappings associated with the hapijs vendor. It collects a comprehensive set of security vulnerabilities affecting the hapijs Node.js web framework, covering historical data from the early 2010s through recent disclosures. Here, you can track the vendor’s official security advisories, understand the specific characteristics of a weakness class such as HTTP header injection or path traversal, and look up the product’s vulnerability history to assess long-term risk trends. The hapijs framework, while powerful for building RESTful APIs, has been subject to various security reviews that highlight potential misconfigurations and input validation failures. By examining the aggregated data, security professionals can identify patterns in how vulnerabilities are reported, patched, and exploited over time. This resource serves as a centralized reference point for understanding the security posture of hapijs, allowing teams to correlate internal application usage with known external threats. It does not provide real-time alerting or automated patching solutions but rather offers static analytical insights into the product’s past and present security landscape. Users can compare different vulnerability types to prioritize remediation efforts based on severity and exploitability. The data is organized to facilitate easy navigation for researchers and developers who need to audit their dependencies against known flaws without sifting through scattered blog posts or individual CVE databases.

CVE ID Title CVSS Severity Published
CVE-2026-122131 Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key — joi CWE-1321 3.7 Low 2026-11-04
CVE-2026-119202 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service — content CWE-1333 7.5 High 2026-10-29
CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service — joi CWE-1333 7.5 High 2026-10-29
CVE-2026-115728 @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing — @hapi/content CWE-1333 7.5 High 2026-10-23
CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate — joi CWE-1333 7.5 High 2026-09-16
CVE-2026-90771 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages — joi CWE-1321 3.7 Low 2026-09-13
CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages — joi CWE-1321 3.7 Low 2026-09-01
CVE-2026-84367 joi: object().rename() with a template target can set the validated object's prototype — joi CWE-1321 3.7 Low 2026-09-01
CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path — inert CWE-22 5.3 Medium 2026-07-17
CVE-2026-48022 @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects — wreck CWE-319 6.5 Medium 2026-07-17
CVE-2026-44979 @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects — wreck CWE-200 - - 2026-07-17
CVE-2026-44974 Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters — content CWE-436 - - 2026-07-17
CVE-2026-48038 joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas — joi CWE-248 5.3 Medium 2026-07-14
CVE-2026-35213 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing — content CWE-1333 7.5AI High AI 2026-04-06
CVE-2023-25166 Regular Expression Denial of Service (ReDoS) Vulnerability — formula CWE-1333 5.5 Medium 2023-02-08

This page lists every published CVE security advisory associated with hapijs. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.