CVE-2026-119202— @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Quick assessment

Affected

hapijs content

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

库用于解析 HTTP 的响应头。在 3.0.6 至 6.0.3 版本中，方法在全局正则表达式扫描中使用了未锚定的参数名表达式。当头中的某个参数包含一个不含等号的长令牌（token）时，会导致对剩余输入内容反复进行匹配失败。由此引发的二次方（O(n²)）处理复杂度可能阻塞 Node.js 事件循环，从而在路由处理器或验证逻辑执行之前造成拒绝服务。该问题在以下场景中尤为严重：当解析请求头时；在启用了的未认证 Hapi 路由中；任何直接将不可信请求头传递给的应用程序。此漏洞已在 6.0.3 版本中

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Source: CVE Program / CVE List V5

Vulnerability Description

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1333

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
hapijs	content	< 6.0.3	-

II. Public POCs for CVE-2026-119202

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119202

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-119202 (1)

🔗 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service · Advisory · hapijs/content · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-119202 (1)

🔗 Release v6.0.3 · hapijs/content · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119202

IV. Related Vulnerabilities

Same product: content

Same vendor: hapijs

Same weakness: CWE-1333