Hapi
Monthly
@hapi/content 3.0.6 through 6.0.2 parse Content-Disposition parameters in time that grows with the square of a single parameter token's length, so one unauthenticated multipart/form-data request can freeze the Node.js event loop for seconds to minutes. Because @hapi/pez calls Content.disposition() on every part header before the route handler and before any validation, every hapi route with payload.multipart enabled - including auth:false routes - is remotely reachable by an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact); applications that hand untrusted headers straight to Content.disposition() are exposed the same way. The GitHub advisory ships a runnable proof-of-concept that measured roughly 7.2 seconds of blocking from a 128 KB token against the 1 MB default payload.maxBytes, and no CISA KEV entry or active-exploitation reporting accompanies this CVE; the flaw is fixed in @hapi/content 6.0.3.
Joi, the JavaScript schema validation library published on npm as joi (17.1.1 through 17.13.8, and 18.0.0 through 18.3.0) and as @hapi/joi from 16.0.0 onward, takes quadratic time in String.prototype.split whenever the Joi.string().email({ multiple: true }) rule processes a value containing a long run of whitespace with no separator, allowing a single request to stall the Node.js event loop for seconds. The vendor advisory measures roughly 3.3 seconds for 100,000 spaces and 13.6 seconds for 200,000 spaces on joi@18.3.0, dropping to 0-1 ms after the fix; the root cause is CWE-1333 (inefficient regular expression complexity) and the impact is pure CPU-exhaustion denial of service with no confidentiality or integrity effect. Exploitation requires the application to validate untrusted input with the multiple option and to have no effective length limit before the email rule runs; remote, unauthenticated attackers can trigger it where such a route is public (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). There is no CISA KEV entry and no confirmed active exploitation; the GitHub security advisory itself contains a proof-of-concept benchmark snippet, and the vulnerability is fixed in 17.13.9 and 18.3.1.
formula is a math and string formula parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
@hapi/content 3.0.6 through 6.0.2 parse Content-Disposition parameters in time that grows with the square of a single parameter token's length, so one unauthenticated multipart/form-data request can freeze the Node.js event loop for seconds to minutes. Because @hapi/pez calls Content.disposition() on every part header before the route handler and before any validation, every hapi route with payload.multipart enabled - including auth:false routes - is remotely reachable by an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact); applications that hand untrusted headers straight to Content.disposition() are exposed the same way. The GitHub advisory ships a runnable proof-of-concept that measured roughly 7.2 seconds of blocking from a 128 KB token against the 1 MB default payload.maxBytes, and no CISA KEV entry or active-exploitation reporting accompanies this CVE; the flaw is fixed in @hapi/content 6.0.3.
Joi, the JavaScript schema validation library published on npm as joi (17.1.1 through 17.13.8, and 18.0.0 through 18.3.0) and as @hapi/joi from 16.0.0 onward, takes quadratic time in String.prototype.split whenever the Joi.string().email({ multiple: true }) rule processes a value containing a long run of whitespace with no separator, allowing a single request to stall the Node.js event loop for seconds. The vendor advisory measures roughly 3.3 seconds for 100,000 spaces and 13.6 seconds for 200,000 spaces on joi@18.3.0, dropping to 0-1 ms after the fix; the root cause is CWE-1333 (inefficient regular expression complexity) and the impact is pure CPU-exhaustion denial of service with no confidentiality or integrity effect. Exploitation requires the application to validate untrusted input with the multiple option and to have no effective length limit before the email rule runs; remote, unauthenticated attackers can trigger it where such a route is public (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). There is no CISA KEV entry and no confirmed active exploitation; the GitHub security advisory itself contains a proof-of-concept benchmark snippet, and the vulnerability is fixed in 17.13.9 and 18.3.1.
formula is a math and string formula parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.