CVSS 3.0
5.9 mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2015-9243
Medium (5.9) in hapijs hapi. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in hapi 11.1.4.
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-254, CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hapijs:hapi
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j3g2-m5jj-6336 | npm | hapi | <11.1.4 | 11.1.4 |