Is CVE-2015-9243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-9243 being exploited in the wild.

How severe is CVE-2015-9243?

Informational severity, published 1 September 2020.

Which products and versions are affected?

hapi (npm) SEMVER:introduced=0,fixed=11.1.4.

Is there a fix for CVE-2015-9243?

Yes. hapi (npm): upgrade to 11.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-9243 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-9243?

Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-9243: hapi CORS configuration merge vulnerability

CVE-2015-9243 · Severity: info · Published 2020-09-01

hapi is a Node.js web application framework that manages HTTP request handling and routing. A flaw in versions prior to 11.1.4 causes route-level CORS (Cross-Origin Resource Sharing) settings to unsafely override server-level defaults, potentially allowing cross-origin requests that should have been blocked. This could expose sensitive data or enable unauthorized API access from untrusted domains.

Technologies: hapi (npm). Vendors: npm.

Quick answers

Is CVE-2015-9243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-9243 being exploited in the wild.
How severe is CVE-2015-9243?: Informational severity, published 1 September 2020.
Which products and versions are affected?: hapi (npm) SEMVER:introduced=0,fixed=11.1.4.
Is there a fix for CVE-2015-9243?: Yes. hapi (npm): upgrade to 11.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-9243 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-9243?: Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hapi (npm): upgrade to 11.1.4 or later
```
npm install hapi@11.1.4
```

Technical details

The vulnerability is a configuration merge defect (CWE-284: Improper Access Control) affecting hapi's CORS handling. When a route specifies any CORS configuration, the framework incorrectly merges it with connection-level or server-level CORS defaults instead of properly inheriting them, resulting in missing or weakened CORS restrictions (e.g., credentials flags dropped). The issue affects all versions prior to 11.1.4 and requires no authentication or special preconditions—any HTTP preflight or actual cross-origin request will trigger the flaw. The impact is misconfigured CORS policies that may be more permissive than intended. Fix: update to hapi 11.1.4 or later.

Affected products

hapi hapi prior to 11.1.4

Identifiers

CVE-2015-9243
GHSA-j3g2-m5jj-6336

Timeline

2015-12-17: disclosed: Issue reported on GitHub
2015: patched: Fixed in version 11.1.4
2020-09-01: advisory: GHSA advisory published

References

https://github.com/hapijs/hapi/issues/2980

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.