Unknown · @Hapi/Content · CVE-2026-35213
**Name of the Vulnerable Software and Affected Versions**
@hapi/content versions through 6.0.0
**Description**
@hapi/content is susceptible to Regular Expression Denial of Service (ReDoS) through crafted HTTP header values. Three regular expressions used to parse `Content-Type` and `Content-Disposition` headers contain patterns susceptible to catastrophic backtracking. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value.
**Recommendations**
Upgrade to version 6.0.1 or later.