CVE-2014-7193
CORS Token Disclosure in crumb
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
Exploit likelihood
What each source reports
NVD Score used
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
- Record
CVE-2014-7193- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
- Record
CVE-2014-7193- Updated
- 2026-11-02
EUVDEUVD-2017-0189 No score
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
- Record
EUVD-2017-0189- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-84fq-6626-w5fg No score
CORS Token Disclosure in crumb
When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.
A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.
Recommendation
Update to version 3.0.0 or greater.
- Record
GHSA-84fq-6626-w5fg- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-84fq-6626-w5fg No score
CORS Token Disclosure in crumb
When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.
A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.
Recommendation
Update to version 3.0.0 or greater.
- Record
GHSA-84fq-6626-w5fg- Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
crumbnpm |
before 3.0.0 | 3.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-7193 is a medium vulnerability (CVSS 5.8) in Sideway Hapi Crumb, published December 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 71st percentile. Fixed in crumb 3.0.0.