When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
| Link | Tags |
|---|---|
| https://github.com/hapijs/hapi/issues/2980 | issue tracking exploit third party advisory |
| https://nodesecurity.io/advisories/65 | third party advisory |