### [CVE-2015-9243](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9243)
![](https://img.shields.io/static/v1?label=Product&message=hapi%20node%20module&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Control%20-%20Generic%20(CWE-284)&color=brighgreen)

### Description

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon