CVE-2015-9243: Unsafe Merging of CORS Configuration Conflict in hapi

September 1, 2020 (updated January 7, 2021)

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins *).

References

github.com/advisories/GHSA-j3g2-m5jj-6336
github.com/hapijs/hapi/issues/2980
nodesecurity.io/advisories/65
nvd.nist.gov/vuln/detail/CVE-2015-9243
www.npmjs.com/advisories/65

Code Behaviors & Features

Detect and mitigate CVE-2015-9243 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →