CVE-2016-10543

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-05-31 · updated 2026-06-17
Weakness: CWE-20

Description

call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules.

Affected products

HackerOne call node module: from 2.0.1 through 3.0.1

References

https://github.com/hapijs/hapi/issues/3228
https://nodesecurity.io/advisories/121
https://github.com/hapijs/hapi/issues/3228
https://nodesecurity.io/advisories/121

Get alerted when CVE-2016-10543 or the next vulnerability affects your stack