GitHub Advisoryadvisory · npm

GHSA-jg4p-7fhp-p32p @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing

HIGH Published 2026-04-04 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-35213
Ecosystem
npm
Packages
@hapi/content
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2026-04-04

Affected packages

• npm @hapi/content: < 6.0.1 → fixed in 6.0.1

Description

All versions of `@hapi/content` through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse `Content-Type` and `Content-Disposition` headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1. Impact Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value. Patches Fixed by tightening all three regular expressions to eliminate backtracking. Workarounds There are no known workarounds. Upgrade to the patched version.

Related

Alias · CVE (1)

  • CVE-2026-35213 @hapi/content provided HTTP Content-* headers parsing. vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References