These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A remote attacker can stall a vulnerable application with a single request by supplying a string to an isoDate validation, due to a regular expression denial of service in the Joi library. This vulnerability affects applications using Joi versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6. The issue arises from an unanchored regular expression in the Joi.string().isoDate() validation rule, which can cause th [truncated]
CVE-2026-84367 Joi Prototype Pollution Vulnerability. This vulnerability affects Joi versions between 16.0.0 and 17.13.4 or 18.2.3. An attacker can exploit this by sending a specially crafted input key, potentially causing the prototype of the object returned by validate() to be modified. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. [truncated]
CVE-2026-48049 is a medium-severity vulnerability in @hapi/inert, a static file and directory handler for hapi.js. The vulnerability allows unauthenticated remote attackers to read files via a directory traversal attack. The issue arises from a flawed confinement check that compares the resolved absolute path against the confine directory using a raw string-prefix test. This allows an attacker to access f [truncated]
CVE-2026-48022 is a MEDIUM severity vulnerability in @hapi/wreck, an HTTP client utility. The issue allows credentials to be forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, enabling a co-tenant on an adjacent port or a network-position attacker to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue i [truncated]
CVE-2026-44979 is a MEDIUM severity vulnerability in @hapi/wreck, an HTTP client utility. Prior to version 18.1.1, the library improperly handles 3xx redirects, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled. This issue arises because @hapi/wreck only strips the Authorization and Cookie headers during redirects, but not the Proxy-Aut [truncated]
CVE-2026-44974 is a HIGH severity vulnerability in @hapi/content. Prior to version 6.0.2, the Content.disposition() function retained the last occurrence of each duplicate parameter, while Content.type() retained the first occurrence of duplicate charset and boundary parameters. This inconsistency creates a parameter-smuggling primitive when another component in the request-processing chain resolves dupli [truncated]
CVE-2026-35213 is a Regular Expression Denial of Service (ReDoS) vulnerability in @hapi/content through version 6.0.0. The vulnerability is caused by three regular expressions used to parse Content-Type and Content-Disposition headers containing patterns susceptible to catastrophic backtracking. This issue has been fixed in version 6.0.1. Affected deployments should be reviewed for exposure and updated to [truncated]