CVE-2026-119202 with a CVSS score of 7.5 is a denial-of-service vulnerability in the @hapi/content npm package, specifically in the Content.disposition() function used to parse Content-Disposition header parameters. The flaw is quadratic-time parsing caused by an unanchored regular expression that repeatedly scans long parameter-name tokens without an equals sign, making processing time grow with the square of token length. It is exploited over the network by an unauthenticated attacker who sends a normal-size multipart/form-data request containing a long Content-Disposition token; in hapi applications, parsing occurs before route handlers and validation on routes with payload.multipart enabled, so no authentication or special privileges are required. The affected versions are stated as every release from 3.0.6 (published as content) up to and including @hapi/content 6.0.2, with affected software listed as @hapi/content (npm) versions ≤ 6.0.2 and content (npm) versions ≥ 3.0.6, ≤ 4.0.6. Business impact is service unavailability because one request can block the Node.js event loop for seconds to minutes, preventing the server from responding to other clients, and repeated requests can keep the service unavailable.
We recommend you to update @hapi/content to version 6.0.3.[/subscribe_to_unlock_form]
CVE-2026-119202 with a CVSS score of 7.5 is a denial-of-service vulnerability in the @hapi/content npm package, specifically in the Content.disposition() function used to parse Content-Disposition header parameters. The flaw is quadratic-time parsing caused by an unanchored regular expression that repeatedly scans long parameter-name tokens without an equals sign, making processing time grow with the square of token length. It is exploited over the network by an unauthenticated attacker who sends a normal-size multipart/form-data request containing a long Content-Disposition token; in hapi applications, parsing occurs before route handlers and validation on routes with payload.multipart enabled, so no authentication or special privileges are required. The affected versions are stated as every release from 3.0.6 (published as content) up to and including @hapi/content 6.0.2, with affected software listed as @hapi/content (npm) versions ≤ 6.0.2 and content (npm) versions ≥ 3.0.6, ≤ 4.0.6. Business impact is service unavailability because one request can block the Node.js event loop for seconds to minutes, preventing the server from responding to other clients, and repeated requests can keep the service unavailable.
We recommend you to update @hapi/content to version 6.0.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]