CVE-2014-4671: Rosetta-Flash JSONP Vulnerability in hapi
Summary
CVE-2014-4671: Rosetta-Flash JSONP Vulnerability in hapi. Affects hapi versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
hapi is an open-source framework for building applications and services in Node.js. It provides a robust set of tools and utilities for creating server applications. However, versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be exploited by attackers to send data across domains and bypass the browser's same-origin policy.
Vulnerability Detail
The rosetta-flash vulnerability in hapi allows malicious actors to abuse JSONP endpoints to perform cross-domain data exfiltration. By leveraging this vulnerability, an attacker can send sensitive data from a victim's browser to a different domain, potentially leading to unauthorized access or data leakage. This vulnerability is rated as moderate in severity (CWE-352).
How To Fix
Latest published version: 18.1.0 as of 22 Oct 2026
npm install hapi@18.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.1.0
This is the first release that contains the fix.
npm install hapi@6.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Alternatively, you can implement a solution previously used by Google, Facebook, and Github. This workaround involves prepending callbacks with an empty inline comment. By doing so, the flash parser in hapi will break on invalid inputs, effectively preventing the rosetta-flash vulnerability. Here's an example of how to apply the workaround:
// Original callback
callback(data);
// Workaround callback
callback(/* */ data);
Conclusion
The rosetta-flash vulnerability in hapi can be mitigated by updating to version 6.1.1 or later. Alternatively, you can apply a workaround by using the empty inline comment technique. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hapi →
FAQ
The rosetta-flash vulnerability allows attackers to bypass the same-origin policy and send data across domains. This can lead to unauthorized access, data leakage, and potential security breaches.
Versions 6.1.0 and earlier of hapi are vulnerable to the rosetta-flash attack. It is recommended to update to version 6.1.1 or later to mitigate the vulnerability.
There are known exploits that leverage the rosetta-flash vulnerability in hapi. Attackers can use this vulnerability to exfiltrate sensitive data from a victim's browser to a different domain.
Yes, a fix is available for the rosetta-flash vulnerability in hapi. It is recommended to update hapi to version 6.1.1 or later to address the issue.
Yes, you can implement a workaround by prepending callbacks with an empty inline comment. This will cause the flash parser in hapi to break on invalid inputs and prevent the rosetta-flash vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for hapi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
