GHSA-jg4p-7fhp-p32p

    Dashboard / Vulnerabilities / GHSA-jg4p-7fhp-p32p

    GHSA-jg4p-7fhp-p32p

    Published: 4 Apr 2026Last Modified: 24 Oct 2026

    Summary: @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing

    Details: All versions of `@hapi/content` through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse `Content-Type` and `Content-Disposition` headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1. ### Impact Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value. ### Patches Fixed by tightening all three regular expressions to eliminate backtracking. ### Workarounds There are no known workarounds. Upgrade to the patched version.

    References: https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p, https://nvd.nist.gov/vuln/detail/CVE-2026-35213, https://github.com/hapijs/content/pull/38, https://github.com/hapijs/content

    Affected packages

    Package

    Name: @hapi/content

    Purl: pkg:npm/%40hapi/content

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -6.0.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-jg4p-7fhp-p32p | CVE-DB