CVE-2016-10549: Sails Broken CORS Vulnerability
Summary
CVE-2016-10549: Sails before 0.12.7 vulnerable to Broken CORS. Affects sails versions < 0.12.7. Fixed in 0.12.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Sails is an open-source web application framework for Node.js that follows the Model-View-Controller (MVC) architectural pattern. It provides a robust set of features for building scalable and maintainable web applications. However, versions of Sails before 0.12.7 are vulnerable to a Broken CORS issue.
Vulnerability Detail
The vulnerability in Sails arises from a misconfiguration in the Cross-Origin Resource Sharing (CORS) settings. When the allRoutes option is set to true and the origin option is set to * or left commented out, the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This allows an attacker to bypass the Same Origin Policy and make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML document. The impact of this vulnerability can be compounded when the credentials setting is not provided, as it enables authenticated cross-domain requests.
How To Fix
Latest published version: 1.5.18 as of 22 Oct 2026
npm install sails@1.5.18Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.7
This is the first release that contains the fix.
npm install sails@0.12.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, updating to the latest version of Sails and configuring the CORS settings properly will address the issue.
Conclusion
The Broken CORS vulnerability in Sails can be mitigated by updating to the latest version and properly configuring the CORS settings. It is important to follow the recommended steps to ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for sails →
FAQ
Sails is an open-source web application framework for Node.js that follows the Model-View-Controller (MVC) architectural pattern. It provides a robust set of features for building scalable and maintainable web applications.
The vulnerability allows an attacker to bypass the Same Origin Policy and make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML document. This can lead to unauthorized access or data leakage.
To mitigate this vulnerability, update to version 0.12.7 or later of Sails and configure the CORS settings properly. Avoid setting allRoutes to true with origin set to *, and uncomment the origin option, setting it to a reasonable value. Also, uncomment the credentials option and set it to the appropriate value.
There is no specific workaround mentioned for this vulnerability. Updating to the latest version of Sails and configuring the CORS settings properly is the recommended approach.
You can find more information about this vulnerability in the official GitHub advisory: [link to advisory].
Related vulnerabilities
Recent vulnerabilities recorded for sails.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
