Affected versions of call do not validate empty parameters, which may result in a bypass of route validation rules.

Proof of Concept

Routing Scheme:

/api/{param}/{param2}/details

Triggering Request Path:

/api///

Recommendation

Update to version 3.0.2 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10543
• hapijs/hapi#3228
• GHSA-84fv-prrc-5ggr
• https://www.npmjs.com/advisories/121