@hapi/content: ReDoS in Content.disposition() parameter parsing
Summary
@hapi/content versions 6.0.1 before 6.0.3 contain a regular expression denial of service flaw in Content.disposition(). It is an incomplete fix for CVE-2026-35213. An unauthenticated remote attacker can send a multipart upload with a long Content-Disposition parameter that lacks an equals sign, causing quadratic backtracking that blocks the Node.js event loop. Internet-facing Node.js applications that accept multipart uploads are at risk of service outages.
Affected
- @hapi/content 6.0.1 to before 6.0.3
- Applications that depend on this package directly or through hapi and related packages
Fixed in
- @hapi/content 6.0.3
Workaround
Unknown. No vendor workaround published. Upgrading to 6.0.3 is the fix.
Exploitation
- CISA SSVC (from the CVE record): exploitation none, automatable yes, technical impact partial
- No public proof of concept found at the time of writing
- Not listed in CISA KEV according to a third-party aggregator; verify at cisa.gov
Our recommendation
- Identify all Node.js projects that use @hapi/content, including indirect dependencies, using lockfiles
- Update to 6.0.3, regenerate the lockfile and redeploy
- Prioritise internet-facing services with multipart upload endpoints
- Until patched, limit request header and body sizes at the reverse proxy or WAF and enforce timeouts on upload endpoints
- Check the vendor advisory and NVD entry for updates, as NVD analysis was pending
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record references: GitHub commit 0993851 (fix) github.com
- @hapi/content release v6.0.3 (fixed version) github.com
- hapijs/content security advisory GHSA-jg4p-7fhp-p32p github.com
- VulnCheck advisory: @hapi/content ReDoS via Content.disposition() www.vulncheck.com
- hapijs/content lib/index.js at v6.0.2 (vulnerable code) github.com
- OSV entry GHSA-jg4p-7fhp-p32p osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:31.
Original description (NVD)
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
NVD references (6)
- https://github.com/hapijs/content/blob/v6.0.2/lib/index.js#L96
- https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd
- https://github.com/hapijs/content/pull/42
- https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p
- https://github.com/hapijs/content/tree/v6.0.3
- https://www.vulncheck.com/advisories/hapi-content-6.0.1-before-6.0.3-redos-via-content-disposition-parameter-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.