Executive brief
hapi is a Node.js web application framework that manages HTTP request handling and routing. A flaw in versions prior to 11.1.4 causes route-level CORS (Cross-Origin Resource Sharing) settings to unsafely override server-level defaults, potentially allowing cross-origin requests that should have been blocked. This could expose sensitive data or enable unauthorized API access from untrusted domains.
Technical details
The vulnerability is a configuration merge defect (CWE-284: Improper Access Control) affecting hapi's CORS handling. When a route specifies any CORS configuration, the framework incorrectly merges it with connection-level or server-level CORS defaults instead of properly inheriting them, resulting in missing or weakened CORS restrictions (e.g., credentials flags dropped). The issue affects all versions prior to 11.1.4 and requires no authentication or special preconditions—any HTTP preflight or actual cross-origin request will trigger the flaw. The impact is misconfigured CORS policies that may be more permissive than intended. Fix: update to hapi 11.1.4 or later.
Affected products
- hapi hapi prior to 11.1.4
Timeline
- 2015-12-17: disclosed: Issue reported on GitHub
- 2015: patched: Fixed in version 11.1.4
- 2020-09-01: advisory: GHSA advisory published