HackerOne

Hapi hoek node module: Modification of Assumed-Immutable Data (MAID)

HackerOne hapi node module: Uncontrolled Resource Consumption

also in 1 other product

Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

HackerOne hapi node module: Uncontrolled Resource Consumption

also in 1 other product

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Hapijs Hoek: security vulnerability

HackerOne nes node module: Uncontrolled Resource Consumption

also in 1 other product

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Hapijs Content: Interpretation Conflict

HackerOne hapi node module: Improper Access Control

also in 1 other product

joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

@hapi/inert: Static-file confinement bypass via sibling-prefix path

Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing

@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects

joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas

HackerOne hapi node module: Improper Access Control

also in 1 other product

Regular Expression Denial of Service (ReDoS) Vulnerability

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

joi: Prototype pollution via a `__proto__` language key in custom messages

joi: object().rename() with a template target can set the validated object's prototype