{"affected":[{"product":"content","source":"CNA: GitHub_M","vendor":"hapijs","versions":[{"status":"affected","version":"< 6.0.3"}]},{"ecosystem":"npm","packageName":"@hapi/content","product":"@hapi/content","source":"GitHub GHSA-8494-f6mr-cjpv","vendor":"","versions":[{"status":"affected","version":"<= 6.0.2","versionType":"GitHub advisory range"}]},{"ecosystem":"npm","packageName":"content","product":"content","source":"GitHub GHSA-8494-f6mr-cjpv","vendor":"","versions":[{"status":"affected","version":">= 3.0.6, <= 4.0.6","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@hapi/content","product":"@hapi/content","source":"OSV GHSA-8494-f6mr-cjpv","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"6.0.3"}],"lessThan":"6.0.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"content","product":"content","source":"OSV GHSA-8494-f6mr-cjpv","vendor":"","versions":[{"events":[{"introduced":"3.0.6"},{"last_affected":"4.0.6"}],"lessThanOrEqual":"4.0.6","status":"affected","version":"3.0.6","versionType":"semver"}]}],"cveId":"CVE-2026-119202","cwes":["CWE-1333"],"description":"@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.","epss":{"date":"2026-11-04","percentile":0.35571,"score":0.00411},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793726284610,"publishedAt":1793305457210,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/content/releases/tag/v6.0.3"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/hapijs/content/releases/tag/v6.0.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-8494-f6mr-cjpv"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-8494-f6mr-cjpv","text":"@hapi/content (npm): GitHub reports patched versions 6.0.3. Check the advisory for the affected release branch.","url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"},{"kind":"fix","source":"OSV GHSA-8494-f6mr-cjpv","text":"@hapi/content (npm): OSV reports a fixed version 6.0.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv"}],"revision":"862f37e95b13ed9c008636153aabac0aaf9d3d969cfd6c8e11f2efa44d28f892","sources":[{"modifiedAt":1793723931796,"name":"CNA: GitHub_M","retrievedAt":1793725842154,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119202"},{"modifiedAt":1793726284610,"name":"NVD","retrievedAt":1793729941941,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119202"},{"modifiedAt":1793305377000,"name":"GitHub Security Advisories","retrievedAt":1793804709683,"url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"},{"modifiedAt":1793402104478,"name":"OSV / GitHub Security Advisories","retrievedAt":1793725844337,"url":"https://osv.dev/vulnerability/GHSA-8494-f6mr-cjpv"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793858223728,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119202"}],"ssvc":{"assessedAt":1793723868843,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service","updatedAt":1793858223728}