CORS Token Disclosure Affecting crumb package, versions <3.0.0



    Attack Complexity Low
    User Interaction Required

    Threat Intelligence

    EPSS 0.27% (67th percentile)
Expand this section
5.4 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID npm:crumb:20140801
  • published 1 Aug 2014
  • disclosed 1 Aug 2014
  • credit Marcus Stong

How to fix?

Update crumb to version 3.0.0 or greater.


When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.

Source: Node Security Project