CVE-2015-9243

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-05-29 · updated 2026-06-17
Weakness: CWE-284

Description

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).

Affected products

HackerOne hapi node module: before 11.1.4 — fixed in 11.1.4

How to fix

Upgrade to a fixed version: HackerOne hapi node module 11.1.4. Check the vendor advisory for mitigations.

References

https://github.com/hapijs/hapi/issues/2980
https://nodesecurity.io/advisories/65
https://github.com/hapijs/hapi/issues/2980
https://nodesecurity.io/advisories/65

Get alerted when CVE-2015-9243 or the next vulnerability affects your stack