CVE-2026-119202
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
@hapi/content from 3.0.6 until 6.0.3 uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers, including unauthenticated hapi routes with payload.multipart enabled.
Risk Assessment
An attacker can send a crafted multipart/form-data header to block the Node.js event loop and cause a denial of service, even without authentication. The risk affects hapi applications accepting multipart data and those passing untrusted headers to Content.disposition().
Recommendation
Update @hapi/content to version 6.0.3 or later. Avoid passing untrusted headers directly to Content.disposition().
Other vulnerabilities in @hapi/content
See all- CVE-2026-115728High
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
- CVE-2026-44974High
Vulnerability in the @hapi/content library (versions before 6.0.2) for parsing HTTP Content-* headers. Different handling of duplicate parameters can lead to parameter smuggling and bypass of filename allowlists.
- CVE-2026-35213High
The @hapi/content library through version 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.
Original NVD description (English source)
@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS