Content
Monthly
@hapi/content 3.0.6 through 6.0.2 parse Content-Disposition parameters in time that grows with the square of a single parameter token's length, so one unauthenticated multipart/form-data request can freeze the Node.js event loop for seconds to minutes. Because @hapi/pez calls Content.disposition() on every part header before the route handler and before any validation, every hapi route with payload.multipart enabled - including auth:false routes - is remotely reachable by an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact); applications that hand untrusted headers straight to Content.disposition() are exposed the same way. The GitHub advisory ships a runnable proof-of-concept that measured roughly 7.2 seconds of blocking from a 128 KB token against the 1 MB default payload.maxBytes, and no CISA KEV entry or active-exploitation reporting accompanies this CVE; the flaw is fixed in @hapi/content 6.0.3.
@hapi/content 3.0.6 through 6.0.2 parse Content-Disposition parameters in time that grows with the square of a single parameter token's length, so one unauthenticated multipart/form-data request can freeze the Node.js event loop for seconds to minutes. Because @hapi/pez calls Content.disposition() on every part header before the route handler and before any validation, every hapi route with payload.multipart enabled - including auth:false routes - is remotely reachable by an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact); applications that hand untrusted headers straight to Content.disposition() are exposed the same way. The GitHub advisory ships a runnable proof-of-concept that measured roughly 7.2 seconds of blocking from a 128 KB token against the 1 MB default payload.maxBytes, and no CISA KEV entry or active-exploitation reporting accompanies this CVE; the flaw is fixed in @hapi/content 6.0.3.