CORS Token Disclosure Affecting crumb Open this link in a new tab package, versions <3.0.0

  • Attack Complexity


  • User Interaction


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    1 Aug 2014

  • disclosed

    1 Aug 2014

  • credit

    Marcus Stong

How to fix?

Update crumb to version 3.0.0 or greater.


When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.

Source: Node Security Project