hapijs vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 202613

Newest CVEs

• CVE-2026-119202

  @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

  hapijs · content

  High7.5
• CVE-2026-118772

  joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

  hapijs · joi

  High7.5
• CVE-2026-115728

  @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

  hapijs · @hapi/content

  High8.7
• CVE-2026-92599

  Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

  hapijs · joi

  High8.7
• CVE-2026-90771

  joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

  hapijs · joi

  Medium6.3
• CVE-2026-84368

  joi: Prototype pollution via a `__proto__` language key in custom messages

  hapijs · joi

  Low3.7
• CVE-2026-84367

  joi: object().rename() with a template target can set the validated object's prototype

  hapijs · joi

  Low3.7
• CVE-2026-48049

  @hapi/inert: Static-file confinement bypass via sibling-prefix path

  hapijs · inert

  Medium5.3
• CVE-2026-48022

  @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

  hapijs · wreck

  Medium6.5
• CVE-2026-44979

  @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects

  hapijs · wreck

  Medium6.3