Skip to content
OpenAdvisories

Package · npm

@hapi/content

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2026-119202

    @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

    @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disp…

    hapijs content @hapi/content content npm
  • High 7.5
    CVE-2026-115728

    @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

    @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Dispos…

    hapijs @hapi/content @hapi/content npm
  • High 7.7
    CVE-2026-44974

    Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters

    @hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a p…

    hapijs content @hapi/content npm
  • High —
    GHSA-3wqh-h42r-x8fq

    Denial of Service in @hapi/content

    Versions of `@hapi/content` prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hap…

    @hapi/content npm