Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hapijs/boom

              master @ 7bd1aaf
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Reflected XSS: 1 prior fix. Scrutinize any change in this area.

lib/index.js: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Error messages constructed within response payloads did not undergo sufficient HTML escaping, allowing malicious user-supplied text to execute in the context of the user's browser session. Developers must consistently apply output encoding on all dynamically generated error properties before they are serialized into response payloads.