Vulnerability in hapijs @hapi/content

[ Description ]Official description

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/hapijs/content/blob/v6.0.2/lib/index.js
• github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd
• github.com/hapijs/content/pull/42
• github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p
• github.com/hapijs/content/tree/v6.0.3
• www.vulncheck.com/advisories/hapi-content-6.0.1-before-6.0.3-redos-via-content-disposit…