Hhapijs

Products

Exploited and recent CVEs

• CVE-2026-122131 Low 3.7 Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key 0.3%
• CVE-2026-119202 High 7.5 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service 0.4%
• CVE-2026-118772 High 7.5 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service 0.5%
• CVE-2026-115728 High 7.5 @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing 0.5%
• CVE-2026-92599 High 7.5 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate 0.6%
• CVE-2026-90771 Low 3.7 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages 0.4%
• CVE-2026-84368 Low 3.7 joi: Prototype pollution via a `__proto__` language key in custom messages 0.4%
• CVE-2026-84367 Low 3.7 joi: object().rename() with a template target can set the validated object's prototype 0.4%
• CVE-2026-48049 Medium 5.3 @hapi/inert: Static-file confinement bypass via sibling-prefix path 0.6%
• CVE-2026-48022 Medium 6.5 @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects 0.2%
• CVE-2026-44979 Medium 6.3 @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects 0.4%
• CVE-2026-44974 High 7.7 Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters 0.5%
• CVE-2026-48038 Medium 5.3 joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas 0.5%
• CVE-2026-35213 High 8.7 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing 0.3%
• CVE-2023-25166 Medium 5.5 Regular Expression Denial of Service (ReDoS) Vulnerability 0.6%