Hapi Content
Monthly
Event-loop-blocking denial of service in @hapi/content 6.0.1 and 6.0.2 lets unauthenticated remote attackers stall a Node.js process by sending a single multipart upload whose Content-Disposition header carries a long parameter with no equals sign, causing quadratic regex backtracking inside Content.disposition(). The bug is an incomplete fix for CVE-2026-35213: the 6.0.1 regex tightening left one parsing path exploitable, so any hapi service that calls Content.disposition() on attacker-controlled headers (typically multipart/form-data routes handled through @hapi/subtext) is exposed with no authentication, privileges or user interaction, though the impact is availability only. Version 6.0.3 completes the fix; a public regression test in the upstream pull request demonstrates the trigger payload, but there is no CISA KEV listing and no confirmed working exploit code at time of analysis, and the vendor documents no workaround other than upgrading.
Event-loop-blocking denial of service in @hapi/content 6.0.1 and 6.0.2 lets unauthenticated remote attackers stall a Node.js process by sending a single multipart upload whose Content-Disposition header carries a long parameter with no equals sign, causing quadratic regex backtracking inside Content.disposition(). The bug is an incomplete fix for CVE-2026-35213: the 6.0.1 regex tightening left one parsing path exploitable, so any hapi service that calls Content.disposition() on attacker-controlled headers (typically multipart/form-data routes handled through @hapi/subtext) is exposed with no authentication, privileges or user interaction, though the impact is availability only. Version 6.0.3 completes the fix; a public regression test in the upstream pull request demonstrates the trigger payload, but there is no CISA KEV listing and no confirmed working exploit code at time of analysis, and the vendor documents no workaround other than upgrading.