Read the docs
TI-2026-82752 Aliases CVE-2026-119202GHSA-8494-f6mr-cjpv

Quadratic-time parsing in @hapi/content allows denial of service

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

@hapi/content versions before 6.0.3 are affected, and the npm package content is listed as affected from 3.0.6 through 4.0.6. Content.disposition() uses an unanchored regular expression in a global scan, so a Content-Disposition parameter with a long token and no equals sign makes parsing quadratic (CWE-1333). An unauthenticated remote attacker can block the Node.js event loop by sending such headers, including to hapi routes with payload.multipart enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-08
Fix Fixed content (hapijs): 6.0.3@hapi/content (npm): 6.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hapijscontentbefore 6.0.36.0.3Patch availableCNA
—@hapi/content (npm)before 6.0.36.0.3Patch availableGHSA-8494-f6mr-cjpv
—content (npm)3.0.6 – 4.0.6—No fix listedGHSA-8494-f6mr-cjpv
  • content Vendorhapijs Affected before 6.0.3 Fixed in 6.0.3 Patch available CNA
  • @hapi/content (npm) Vendor— Affected before 6.0.3 Fixed in 6.0.3 Patch available GHSA-8494-f6mr-cjpv
  • content (npm) Vendor— Affected 3.0.6 – 4.0.6 Fixed in — No fix listed GHSA-8494-f6mr-cjpv

Remediation

Upgrade @hapi/content to version 6.0.3, which fixes the issue. The sources list no fixed version for content.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA content (hapijs) Fixed in 6.0.3
  • Fix · GHSA-8494-f6mr-cjpv @hapi/content (npm) Fixed in 6.0.3 Advisory →

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119202
  2. 2026-10-30 Alias added: GHSA-8494-f6mr-cjpv
  3. 2026-10-30 Fix available: npm/@hapi/[email protected] · GHSA-8494-f6mr-cjpv
  4. 2026-10-30 CVSS score added · GHSA-8494-f6mr-cjpv
  5. 2026-10-30 Weakness changed · GHSA-8494-f6mr-cjpv
  6. 2026-10-30 5 new references · GHSA-8494-f6mr-cjpv
  7. 2026-10-31 Priority changed: MEDIUM → LOW
  8. 2026-11-03 CISA SSVC decision points changed
  9. 2026-11-03 Priority changed: LOW → HIGH

References

Advisory 1

Other 4

  • TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
  • TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
  • TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
  • TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
  • TI-2026-27366 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing CVSS 4.0HIGH 8.7
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences