# Hapi vulnerabilities Source: https://junglewise.ai/threats/vendors/hapi Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/hapi.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 10 vulnerabilities in Hapi: 0 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119202, was published on 29 October 2026. 1 vulnerability in the last four weeks, level on the four before (1). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 2 - All time: 10 (0 critical, 0 exploited in the wild) ## About Hapi A rich framework for building applications and services. ## Latest Hapi vulnerabilities - [CVE-2026-119202: @hapi/content ReDoS in Content-Disposition parsing](https://junglewise.ai/threats/cve-2026-119202-hapi-content-provides-http-content-header-parsing-from-3-0-6) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-81875: HAPI FHIR SHCParser unbounded DEFLATE decompression denial of service](https://junglewise.ai/threats/cve-2026-81875-hapi-fhir-shcparser-unbounded-deflate-decompression-denial-of) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-48022: hapijs @hapi/wreck credential leak in cross-origin redirects](https://junglewise.ai/threats/cve-2026-48022-hapijs-hapi-wreck-credential-leak-in-cross-origin-redirects) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-44979: hapi wreck sensitive information leak in Proxy-Authorization header](https://junglewise.ai/threats/cve-2026-44979-hapi-wreck-sensitive-information-leak-in-proxy-authorization) (medium, CVSS 4, published 17 Jul 2026) - [CVE-2026-44974: hapijs @hapi/content parameter smuggling in header parsing](https://junglewise.ai/threats/cve-2026-44974-hapijs-hapi-content-parameter-smuggling-in-header-parsing) (high, CVSS 4, published 17 Jul 2026) - [CVE-2026-35213: hapijs @hapi/content ReDoS in HTTP header parsing](https://junglewise.ai/threats/cve-2026-35213-hapijs-hapi-content-redos-in-http-header-parsing) (high, CVSS 7.5, published 6 Apr 2026) - [CVE-2020-36604: hapi hoek prototype pollution in clone function](https://junglewise.ai/threats/cve-2020-36604-hapi-hoek-prototype-pollution-in-clone-function) (low, CVSS 3.1, published 25 Sep 2022) - [hapi hoek prototype pollution in clone function](https://junglewise.ai/threats/hapi-hoek-prototype-pollution-in-clone-function-0f3b2840) (info, CVSS 3.7, published 4 Sep 2020) - [hapi @hapi/boom Cross-Site Scripting in error messages](https://junglewise.ai/threats/hapi-hapi-boom-cross-site-scripting-in-error-messages-89fe31b4) (low, CVSS 3.1, published 4 Sep 2020) - [hapi @hapi/content denial of service in HTTP header parser](https://junglewise.ai/threats/hapi-hapi-content-denial-of-service-in-http-header-parser-d6ae9a5f) (info, CVSS 7.5, published 3 Sep 2020) ## Most severe Hapi vulnerabilities - [CVE-2026-81875: HAPI FHIR SHCParser unbounded DEFLATE decompression denial of service](https://junglewise.ai/threats/cve-2026-81875-hapi-fhir-shcparser-unbounded-deflate-decompression-denial-of) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-35213: hapijs @hapi/content ReDoS in HTTP header parsing](https://junglewise.ai/threats/cve-2026-35213-hapijs-hapi-content-redos-in-http-header-parsing) (high, CVSS 7.5, published 6 Apr 2026) - [CVE-2026-119202: @hapi/content ReDoS in Content-Disposition parsing](https://junglewise.ai/threats/cve-2026-119202-hapi-content-provides-http-content-header-parsing-from-3-0-6) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-44974: hapijs @hapi/content parameter smuggling in header parsing](https://junglewise.ai/threats/cve-2026-44974-hapijs-hapi-content-parameter-smuggling-in-header-parsing) (high, CVSS 4, published 17 Jul 2026) - [CVE-2026-48022: hapijs @hapi/wreck credential leak in cross-origin redirects](https://junglewise.ai/threats/cve-2026-48022-hapijs-hapi-wreck-credential-leak-in-cross-origin-redirects) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-44979: hapi wreck sensitive information leak in Proxy-Authorization header](https://junglewise.ai/threats/cve-2026-44979-hapi-wreck-sensitive-information-leak-in-proxy-authorization) (medium, CVSS 4, published 17 Jul 2026) - [CVE-2020-36604: hapi hoek prototype pollution in clone function](https://junglewise.ai/threats/cve-2020-36604-hapi-hoek-prototype-pollution-in-clone-function) (low, CVSS 3.1, published 25 Sep 2022) - [hapi @hapi/boom Cross-Site Scripting in error messages](https://junglewise.ai/threats/hapi-hapi-boom-cross-site-scripting-in-error-messages-89fe31b4) (low, CVSS 3.1, published 4 Sep 2020) - [hapi @hapi/content denial of service in HTTP header parser](https://junglewise.ai/threats/hapi-hapi-content-denial-of-service-in-http-header-parser-d6ae9a5f) (info, CVSS 7.5, published 3 Sep 2020) - [hapi hoek prototype pollution in clone function](https://junglewise.ai/threats/hapi-hoek-prototype-pollution-in-clone-function-0f3b2840) (info, CVSS 3.7, published 4 Sep 2020) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Hapi technologies - [Hapi Content](https://junglewise.ai/threats/technologies/content): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Hapi vulnerabilities", https://junglewise.ai/threats/vendors/hapi, 9 November 2026.