Hapijs
Monthly
@hapi/content 3.0.6 through 6.0.2 parse Content-Disposition parameters in time that grows with the square of a single parameter token's length, so one unauthenticated multipart/form-data request can freeze the Node.js event loop for seconds to minutes. Because @hapi/pez calls Content.disposition() on every part header before the route handler and before any validation, every hapi route with payload.multipart enabled - including auth:false routes - is remotely reachable by an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact); applications that hand untrusted headers straight to Content.disposition() are exposed the same way. The GitHub advisory ships a runnable proof-of-concept that measured roughly 7.2 seconds of blocking from a 128 KB token against the 1 MB default payload.maxBytes, and no CISA KEV entry or active-exploitation reporting accompanies this CVE; the flaw is fixed in @hapi/content 6.0.3.
Joi, the JavaScript schema validation library published on npm as joi (17.1.1 through 17.13.8, and 18.0.0 through 18.3.0) and as @hapi/joi from 16.0.0 onward, takes quadratic time in String.prototype.split whenever the Joi.string().email({ multiple: true }) rule processes a value containing a long run of whitespace with no separator, allowing a single request to stall the Node.js event loop for seconds. The vendor advisory measures roughly 3.3 seconds for 100,000 spaces and 13.6 seconds for 200,000 spaces on joi@18.3.0, dropping to 0-1 ms after the fix; the root cause is CWE-1333 (inefficient regular expression complexity) and the impact is pure CPU-exhaustion denial of service with no confidentiality or integrity effect. Exploitation requires the application to validate untrusted input with the multiple option and to have no effective length limit before the email rule runs; remote, unauthenticated attackers can trigger it where such a route is public (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). There is no CISA KEV entry and no confirmed active exploitation; the GitHub security advisory itself contains a proof-of-concept benchmark snippet, and the vulnerability is fixed in 17.13.9 and 18.3.1.
Event-loop-blocking denial of service in @hapi/content 6.0.1 and 6.0.2 lets unauthenticated remote attackers stall a Node.js process by sending a single multipart upload whose Content-Disposition header carries a long parameter with no equals sign, causing quadratic regex backtracking inside Content.disposition(). The bug is an incomplete fix for CVE-2026-35213: the 6.0.1 regex tightening left one parsing path exploitable, so any hapi service that calls Content.disposition() on attacker-controlled headers (typically multipart/form-data routes handled through @hapi/subtext) is exposed with no authentication, privileges or user interaction, though the impact is availability only. Version 6.0.3 completes the fix; a public regression test in the upstream pull request demonstrates the trigger payload, but there is no CISA KEV listing and no confirmed working exploit code at time of analysis, and the vendor documents no workaround other than upgrading.
Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
@hapi/content 3.0.6 through 6.0.2 parse Content-Disposition parameters in time that grows with the square of a single parameter token's length, so one unauthenticated multipart/form-data request can freeze the Node.js event loop for seconds to minutes. Because @hapi/pez calls Content.disposition() on every part header before the route handler and before any validation, every hapi route with payload.multipart enabled - including auth:false routes - is remotely reachable by an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact); applications that hand untrusted headers straight to Content.disposition() are exposed the same way. The GitHub advisory ships a runnable proof-of-concept that measured roughly 7.2 seconds of blocking from a 128 KB token against the 1 MB default payload.maxBytes, and no CISA KEV entry or active-exploitation reporting accompanies this CVE; the flaw is fixed in @hapi/content 6.0.3.
Joi, the JavaScript schema validation library published on npm as joi (17.1.1 through 17.13.8, and 18.0.0 through 18.3.0) and as @hapi/joi from 16.0.0 onward, takes quadratic time in String.prototype.split whenever the Joi.string().email({ multiple: true }) rule processes a value containing a long run of whitespace with no separator, allowing a single request to stall the Node.js event loop for seconds. The vendor advisory measures roughly 3.3 seconds for 100,000 spaces and 13.6 seconds for 200,000 spaces on joi@18.3.0, dropping to 0-1 ms after the fix; the root cause is CWE-1333 (inefficient regular expression complexity) and the impact is pure CPU-exhaustion denial of service with no confidentiality or integrity effect. Exploitation requires the application to validate untrusted input with the multiple option and to have no effective length limit before the email rule runs; remote, unauthenticated attackers can trigger it where such a route is public (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). There is no CISA KEV entry and no confirmed active exploitation; the GitHub security advisory itself contains a proof-of-concept benchmark snippet, and the vulnerability is fixed in 17.13.9 and 18.3.1.
Event-loop-blocking denial of service in @hapi/content 6.0.1 and 6.0.2 lets unauthenticated remote attackers stall a Node.js process by sending a single multipart upload whose Content-Disposition header carries a long parameter with no equals sign, causing quadratic regex backtracking inside Content.disposition(). The bug is an incomplete fix for CVE-2026-35213: the 6.0.1 regex tightening left one parsing path exploitable, so any hapi service that calls Content.disposition() on attacker-controlled headers (typically multipart/form-data routes handled through @hapi/subtext) is exposed with no authentication, privileges or user interaction, though the impact is availability only. Version 6.0.3 completes the fix; a public regression test in the upstream pull request demonstrates the trigger payload, but there is no CISA KEV listing and no confirmed working exploit code at time of analysis, and the vendor documents no workaround other than upgrading.
Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.