Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-119202

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hapijs
Products
Content
CVE-2026-115728

@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hapijs
Products
Content
CVE-2026-44974

Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters

@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Hapijs
Products
Content
CVE-2026-35213

Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing

@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Content Project Hapijs
Products
Content Content