@hapi/content vulnerabilities

@hapi/content from 3.0.6 until 6.0.3 uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers, including unauthenticated hapi routes with payload.multipart enabled.

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

Vulnerability in the @hapi/content library (versions before 6.0.2) for parsing HTTP Content-* headers. Different handling of duplicate parameters can lead to parameter smuggling and bypass of filename allowlists.

The @hapi/content library through version 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.