Unsafe Merging of CORS Configuration Conflict in hapi
Versions of hapi prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended.
Recommendation
Update hapi to version 11.1.4 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | hapi | < 11.1.4 | 11.1.4 |
References
- Weakness (CWE)
CWE-284- Platform
- npm
- Package
hapi- Disclosed
- 01.09.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j3g2-m5jj-6336 - CC BY 4.0
Vulnerability history: hapi
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 10.2017 09.2020
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 3
Disclosures per year
- 2017: 1
- 2018: 3
- 2019: 0
- 2020: 3
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Unsafe Merging of CORS Configuration Conflict in hapi this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.