# CVE-2015-9243: hapi CORS configuration merge vulnerability

Source: https://junglewise.ai/threats/cve-2015-9243-hapi-cors-configuration-merge-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2015-9243 · Severity: info · Published 2020-09-01

hapi is a Node.js web application framework that manages HTTP request handling and routing. A flaw in versions prior to 11.1.4 causes route-level CORS (Cross-Origin Resource Sharing) settings to unsafely override server-level defaults, potentially allowing cross-origin requests that should have been blocked. This could expose sensitive data or enable unauthorized API access from untrusted domains.

Technologies: [hapi (npm)](https://junglewise.ai/threats/technologies/hapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-9243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-9243 being exploited in the wild.

**How severe is CVE-2015-9243?** Informational severity, published 1 September 2020.

**Which products and versions are affected?** hapi (npm) SEMVER:introduced=0,fixed=11.1.4.

**Is there a fix for CVE-2015-9243?** Yes. hapi (npm): upgrade to 11.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-9243 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-9243?** Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hapi (npm): upgrade to 11.1.4 or later

  ```sh
  npm install hapi@11.1.4
  ```


## Technical details

The vulnerability is a configuration merge defect (CWE-284: Improper Access Control) affecting hapi's CORS handling. When a route specifies any CORS configuration, the framework incorrectly merges it with connection-level or server-level CORS defaults instead of properly inheriting them, resulting in missing or weakened CORS restrictions (e.g., credentials flags dropped). The issue affects all versions prior to 11.1.4 and requires no authentication or special preconditions—any HTTP preflight or actual cross-origin request will trigger the flaw. The impact is misconfigured CORS policies that may be more permissive than intended. Fix: update to hapi 11.1.4 or later.

## Affected products

- hapi hapi prior to 11.1.4

## Identifiers

- CVE-2015-9243
- GHSA-j3g2-m5jj-6336

## Timeline

- 2015-12-17: disclosed: Issue reported on GitHub
- 2015: patched: Fixed in version 11.1.4
- 2020-09-01: advisory: GHSA advisory published

## References

- [https://github.com/hapijs/hapi/issues/2980](https://github.com/hapijs/hapi/issues/2980)

## Related threats

- [hapi Denial of Service in CORS request handler](https://junglewise.ai/threats/hapi-denial-of-service-in-cors-request-handler-015ee3b1)
- [hapijs hapi Rosetta-Flash JSONP vulnerability](https://junglewise.ai/threats/cve-2014-4671-hapijs-hapi-rosetta-flash-jsonp-vulnerability)
- [hapi denial of service via malformed accept-encoding header](https://junglewise.ai/threats/cve-2017-16013-hapi-denial-of-service-via-malformed-accept-encoding-header)
- [hapi CORS preflight request header handling bypass](https://junglewise.ai/threats/cve-2015-9236-hapi-cors-preflight-request-header-handling-bypass)
- [hapi denial of service in date header parsing](https://junglewise.ai/threats/cve-2015-9241-hapi-denial-of-service-in-date-header-parsing)