CVE-2026-119202
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.
Fixes and workarounds
Fix
@hapi/content (npm): GitHub reports patched versions 6.0.3. Check the advisory for the affected release branch.
Source: GitHub GHSA-8494-f6mr-cjpvFix
@hapi/content (npm): OSV reports a fixed version 6.0.3. Check the advisory for supported release branches.
Source: OSV GHSA-8494-f6mr-cjpvAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| content hapijs |
< 6.0.3 (affected) | CNA: GitHub_M |
@hapi/content@hapi/content
npm |
<= 6.0.2 (affected, GitHub advisory range) | GitHub GHSA-8494-f6mr-cjpv |
contentcontent
npm |
>= 3.0.6, <= 4.0.6 (affected, GitHub advisory range) | GitHub GHSA-8494-f6mr-cjpv |
@hapi/content@hapi/content
npm |
≥ 0; < 6.0.3 (affected, semver); OSV events: introduced 0; fixed 6.0.3Source events (semver)Other versions: unaffected |
OSV GHSA-8494-f6mr-cjpv |
contentcontent
npm |
≥ 3.0.6; ≤ 4.0.6 (affected, semver); OSV events: introduced 3.0.6; last affected 4.0.6Source events (semver)Other versions: unaffected |
OSV GHSA-8494-f6mr-cjpv |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA: GitHub_M |
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD: [email protected] |
Exploit evidence
- https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv
exploit · ADP: CISA-ADP
References
- https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpvCNA: GitHub_M · x_refsource_CONFIRM
- https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fdCNA: GitHub_M · x_refsource_MISC
- https://github.com/hapijs/content/releases/tag/v6.0.3CNA: GitHub_M · x_refsource_MISC
- https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpvADP: CISA-ADP · exploit
- https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd[email protected]
- https://github.com/hapijs/content/releases/tag/v6.0.3[email protected]
- https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv[email protected]
- https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpvGitHub Security Advisories · advisory
- https://github.com/advisories/GHSA-8494-f6mr-cjpvOSV / GitHub Security Advisories · advisory
- https://osv.dev/vulnerability/GHSA-8494-f6mr-cjpvOSV / GitHub Security Advisories · osv
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.