CVE-2026-119202

    Dashboard / Vulnerabilities / CVE-2026-119202

    CVE-2026-119202

    Published: 29 Oct 2026Last Modified: 5 Nov 2026

    Summary: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

    Details: @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.

    References: https://github.com/hapijs/content/releases/tag/v6.0.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119202.json, https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv, https://nvd.nist.gov/vuln/detail/CVE-2026-119202, https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -06f8c9f8bb38251781f89c348ae7760e49ca1f25

    Affected versions

    v6.0.2
    v6.0.1
    v6.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119202 | CVE-DB