# CVE-2016-10549: Sails framework broken CORS configuration validation

Source: https://junglewise.ai/threats/cve-2016-10549-sails-framework-broken-cors-configuration-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2016-10549 · Severity: info · CVSS 5.3 · Published 2019-02-18

Sails is a popular web application framework for Node.js. Versions before 0.12.7 can be misconfigured to allow cross-origin requests from any website, bypassing the browser's Same Origin Policy and enabling attackers to make unauthorized API calls on behalf of authenticated users through malicious web pages.

Technologies: [sails (npm)](https://junglewise.ai/threats/technologies/sails). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-10549 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10549 being exploited in the wild.

**How severe is CVE-2016-10549?** Informational severity, with a CVSS score of 5.3, published 18 February 2019.

**Which products and versions are affected?** sails (npm) SEMVER:introduced=0,fixed=0.12.7.

**Is there a fix for CVE-2016-10549?** Yes. sails (npm): upgrade to 0.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10549 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-10549?** Check whether you run sails (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sails (npm): upgrade to 0.12.7 or later

  ```sh
  npm install sails@0.12.7
  ```


## Technical details

The vulnerability is a broken CORS (Cross-Origin Resource Sharing) configuration issue in Sails framework. When allRoutes is set to true and origin is set to "*" or left commented out, the server reflects the origin header value directly into the Access-Control-Allow-Origin response header without proper validation. This allows any origin to make cross-domain requests. The attack requires the vulnerable configuration to be active (allRoutes: true with origin: "*") and is primarily a configuration error rather than a code defect. The fix in 0.12.7 adds console warnings when overly-permissive CORS settings are detected in production, placing the responsibility on users to configure CORS properly. Patched in version 0.12.7.

## Affected products

- Sails Sails before 0.12.7

## Identifiers

- CVE-2016-10549
- GHSA-qmv4-jgp7-mf68

## Timeline

- 2019-02-18: disclosed

## References

- [https://github.com/balderdashy/sails/commit/0057123a0321be6758845abbeb4290bf418ce542](https://github.com/balderdashy/sails/commit/0057123a0321be6758845abbeb4290bf418ce542)

## Related threats

- [Sails denial of service through virtual socket request](https://junglewise.ai/threats/cve-2023-38504-sails-denial-of-service-through-virtual-socket-request)
- [Sails.js prototype pollution in action module loading](https://junglewise.ai/threats/cve-2021-44908-sails-js-prototype-pollution-in-action-module-loading)
- [Sails denial of service via undefined route OPTIONS request](https://junglewise.ai/threats/sails-denial-of-service-via-undefined-route-options-request-1aa4d10c)