CVE-2015-9236: Incorrect handling of CORS preflight request headers in hapi
Summary
CVE-2015-9236: Incorrect handling of CORS preflight request headers in hapi. Affects hapi versions < 11.0.0. Fixed in 11.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hapi package is a rich framework for building applications and services in Node.js. It provides a robust set of features for handling HTTP requests, routing, and more. However, versions prior to 11.0.0 have a vulnerability related to the incorrect handling of CORS preflight request headers.
Vulnerability Detail
Versions of hapi prior to 11.0.0 implement CORS incorrectly, allowing for configurations that can return inconsistent headers or even allow forbidden cross-origin activities. When a connection has CORS enabled but a specific route has it turned off, and the route is not a GET request, the OPTIONS prefetch request will return the default CORS headers. However, the subsequent actual request will go through without any CORS headers, defeating the purpose of enabling CORS on the route.
How To Fix
Latest published version: 18.1.0 as of 22 Oct 2026
npm install hapi@18.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.0
This is the first release that contains the fix.
npm install hapi@11.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The hapi package prior to version 11.0.0 has a vulnerability related to the incorrect handling of CORS preflight request headers. It is recommended to update to the latest version of hapi to ensure secure and consistent CORS behavior. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for hapi →
FAQ
Hapi is a rich framework for building applications and services in Node.js. It provides a robust set of features for handling HTTP requests, routing, and more.
CORS (Cross-Origin Resource Sharing) is a mechanism that allows resources on a web page to be requested from another domain outside the domain from which the resource originated.
The incorrect handling of CORS preflight request headers can lead to inconsistent or insecure cross-origin activities. This can potentially expose sensitive data or allow unauthorized access to resources.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using package-lock.json.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/06/GHSA-vwrf-r5r4-7775/GHSA-vwrf-r5r4-7775.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for hapi.
