Vulnerabilities in hapijs
15 resultsCVE-2023-25166MEDIUMRegular Expression Denial of Service (ReDoS) VulnerabilityEPSS 0.6%CVE-2026-48049MEDIUM@hapi/inert: Static-file confinement bypass via sibling-prefix pathEPSS 0.6%CVE-2026-92599HIGHJoi before 17.13.7 and 18.2.6 ReDoS via isoDateEPSS 0.6%CVE-2026-48038MEDIUMjoi: Uncaught RangeError on deeply nested input through recursive `link()` schemasEPSS 0.5%CVE-2026-44974HIGHParameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parametersEPSS 0.5%CVE-2026-118772HIGHjoi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceEPSS 0.5%CVE-2026-115728HIGH@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter ParsingEPSS 0.5%CVE-2026-44979MEDIUM@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirectsEPSS 0.4%CVE-2026-119202HIGH@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of serviceEPSS 0.4%CVE-2026-84367LOWjoi: object().rename() with a template target can set the validated object's prototypeEPSS 0.4%CVE-2026-84368LOWjoi: Prototype pollution via a `__proto__` language key in custom messagesEPSS 0.4%CVE-2026-90771MEDIUMjoi before 17.13.8 and 18.2.9 Prototype Pollution via messagesEPSS 0.4%CVE-2026-122131MEDIUMJoi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language KeyEPSS 0.3%CVE-2026-35213HIGHRegular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsingEPSS 0.3%CVE-2026-48022MEDIUM@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirectsEPSS 0.2%