PT-2026-30322 · Npm · @Hapi/Content

Published 2026-04-04 · Updated 2026-04-04 · CVE-2026-35213

OSV

CVSS v4.0

8.7

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.

Impact

Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value.

Patches

Fixed by tightening all three regular expressions to eliminate backtracking.

Workarounds

There are no known workarounds. Upgrade to the patched version.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-35213

GHSA-JG4P-7FHP-P32P

Affected Products

@Hapi/Content

References · 4

• https://osv.dev/vulnerability/GHSA-jg4p-7fhp-p32p · Vendor Advisory
• https://github.com/hapijs/content · Note
• https://github.com/hapijs/content/pull/38 · Note
• https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p · Note