This description taken from the pull request provided by Patrick Kettner.
tl:dr - someone created a alphanum only swf converter, which means that they can in theory use it as a callback at a JSONP endpoint, and as a result, send data across domains.
Prepending callbacks with an empty inline comment breaks the flash parser, and prevents the issue. This is a fairly common solution currently being implemented by Google, Facebook, and GitHub.
Source: Node Security Project
Upgrade to the latest version of hapi.js
Snyk patch available for versions:
- < 6.1.0 >=2.3.0