3vulnerabilities
- Critical0 (0.0%)
- High3 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
content
Ecosystem: npm
Downloads: 229.7 K
- 0CriticalAffects 0 versions
- 3HighAffects 3 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting content, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-8494-f6mr-cjpv | High | @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details `Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`: ```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;'"\s]+\'[\w-]*\'[^;\s]+)|(?:\"([^"]*)\")|([^;\s]*))/g ``` The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. |
| GitHub (opens in a new tab) | |
| GHSA-5854-jvxx-2cg9 | High | Denial of Service in contentVersions of `content` are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services. ## Recommendation This package is deprecated and is now maintained as `@hapi/content`. Please update your dependencies to use |
| GitHub (opens in a new tab) | |
| GHSA-x6wp-rfwh-hcx7 | High | Regular Expression Denial of Service in contentAffected versions of `content` are vulnerable to a regular expression denial of service when parsing malicious `Content-Type` and `Content-Disposition` headers. ## Recommendation Update to version 3.0.6 or later. |
| GitHub (opens in a new tab) |
- GHSA-8494-f6mr-cjpvHigh@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
>= 3.0.6, <= 4.0.6
### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details `Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`: ```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;'"\s]+\'[\w-]*\'[^;\s]+)|(?:\"([^"]*)\")|([^;\s]*))/g ``` The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails.
CVE: CVE-2026-119202
Versions of `content` are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services. ## Recommendation This package is deprecated and is now maintained as `@hapi/content`. Please update your dependencies to use
- GHSA-x6wp-rfwh-hcx7HighRegular Expression Denial of Service in content
< 3.0.7
Affected versions of `content` are vulnerable to a regular expression denial of service when parsing malicious `Content-Type` and `Content-Disposition` headers. ## Recommendation Update to version 3.0.6 or later.
CVE: CVE-2017-16111