CVE-2026-119202 Details
Description
@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.
A denial-of-service vulnerability has been identified in the @hapi/content package, specifically in versions 3.0.6 prior to 6.0.3. The issue arises in the Content.disposition() function, which improperly parses Content-Disposition headers by using an unanchored regular expression. This flaw allows long parameter tokens, lacking an equals sign, to cause excessive backtracking. As a result, the parsing time becomes quadratic, blocking the Node.js event loop for extended periods, particularly on routes that handle multipart/form-data payloads. The vulnerability can be exploited by sending a single multipart upload request with a carefully crafted Content-Disposition header, causing significant delays in server response and disrupting service availability.
Users are advised to upgrade to @hapi/content version 6.0.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd | [email protected] | Source CodeVendor |
| https://github.com/hapijs/content/releases/tag/v6.0.3 | [email protected] | Source CodeVendor |
| https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @hapi/content | <= 6.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |