Hapijs vulnerabilities

Products

• Joi 6
• Hapi 4
• Content 3
• Hoek 2
• Wreck 2

Newest

• hapijs content @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service CVE-2026-119202 Fix available 7.5 HighOctober 29, 2026
• @hapi joi joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service CVE-2026-118772 Fix available 7.5 HighOctober 29, 2026
• hapijs joi Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVE-2026-92599 Fix available 8.7 HighSeptember 16, 2026
• hapijs joi joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVE-2026-90771 Fix available 6.3 MediumSeptember 13, 2026
• hapijs joi joi: Prototype pollution via a `__proto__` language key in custom messages CVE-2026-84368 Fix available 3.7 LowSeptember 1, 2026
• hapijs joi joi: object().rename() with a template target can set the validated object's prototype CVE-2026-84367 Fix available 3.7 LowSeptember 1, 2026
• hapijs inert @hapi/inert: Static-file confinement bypass via sibling-prefix path CVE-2026-48049 Fix available 5.3 MediumJune 11, 2026
• hapijs joi joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas CVE-2026-48038 Fix available 5.3 MediumJune 11, 2026
• hapijs wreck @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects CVE-2026-48022 Fix available 6.5 MediumJune 11, 2026
• hapijs wreck @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects CVE-2026-44979 Fix available 6.3 MediumMay 27, 2026
• hapijs content Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters CVE-2026-44974 Fix available 7.7 HighMay 27, 2026
• content project content Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing CVE-2026-35213 Fix available 8.7 HighApril 4, 2026
• hapijs @hapi/content @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing CVE-2026-115728 Fix available 8.7 HighApril 4, 2026
• awordpresslife formula Regular Expression Denial of Service (ReDoS) Vulnerability CVE-2023-25166 Fix available 5.5 MediumFebruary 8, 2023
• hapijs hoek hoek subject to prototype pollution via the clone function. CVE-2020-36604 Fix available 8.1 HighSeptember 23, 2022
• hapijs nes, hackerone nes node module +1 more Denial of Service in nes CVE-2017-16025 Fix available 5.9 MediumJune 4, 2018
• hapijs hapi, hackerone hapi node module +1 more Denial of Service via malformed accept-encoding header in hapi CVE-2017-16013 Fix available 7.5 HighJune 4, 2018
• hapijs hapi, hackerone hapi node module +1 more Incorrect handling of CORS preflight request headers in hapi CVE-2015-9236 Fix available 5.3 MediumMay 31, 2018
• hackerone hapi node module, hapijs hapi +1 more Unsafe Merging of CORS Configuration Conflict in hapi CVE-2015-9243 Fix available 5.9 MediumMay 29, 2018
• hackerone hapi node module, hapijs hapi +1 more Denial of Service in hapi CVE-2015-9241 Fix available 7.5 HighMay 29, 2018
• hapi hoek node module, hapijs hoek +1 more Prototype Pollution in hoek CVE-2018-3728 Fix available 8.8 HighMarch 30, 2018