Go to packages list

hapi-content

Ecosystem: npm

Downloads: 6.18 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 4HighAffects 4 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
4vulnerabilities
  • Critical0 (0.0%)
  • High4 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (4)

Known vulnerabilities affecting hapi-content, based on data from OSV.

Vulnerabilities affecting hapi-content
IDSeveritySummaryAffected versionsPublishedSource
GHSA-8494-f6mr-cjpvHigh@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details `Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`: ```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;'"\s]+\'[\w-]*\'[^;\s]+)|(?:\"([^"]*)\")|([^;\s]*))/g ``` The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails.
  • < 6.0.3
GitHub (opens in a new tab)
GHSA-36hh-x5p5-jgc8High@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters### Impact The two parsers resolved duplicates inconsistently and silently: - `Content.disposition()` retained the last occurrence of each parameter. - `Content.type()` retained the first occurrence of charset and boundary. Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass: `Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php"` ### Patches
  • < 6.0.2
GitHub (opens in a new tab)
GHSA-jg4p-7fhp-p32pHigh@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsingAll versions of `@hapi/content` through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse `Content-Type` and `Content-Disposition` headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1. ### Impact Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value. ### Patches Fixed by tightening all three regular expressions to eliminate backtrackin
  • < 6.0.1
GitHub (opens in a new tab)
GHSA-3wqh-h42r-x8fqHighDenial of Service in @hapi/contentVersions of `@hapi/content` prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services. ## Recommendation Upgrade to version 5.0.2. Versions 4.1.1 and 5.0.1 are fixed but only avail
  • < 5.0.2
GitHub (opens in a new tab)
  • GHSA-8494-f6mr-cjpvHigh
    @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
    • < 6.0.3
    GitHub (opens in a new tab)

    ### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details `Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`: ```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;'"\s]+\'[\w-]*\'[^;\s]+)|(?:\"([^"]*)\")|([^;\s]*))/g ``` The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails.

    CVE: CVE-2026-119202

  • GHSA-36hh-x5p5-jgc8High
    @hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
    • < 6.0.2
    GitHub (opens in a new tab)

    ### Impact The two parsers resolved duplicates inconsistently and silently: - `Content.disposition()` retained the last occurrence of each parameter. - `Content.type()` retained the first occurrence of charset and boundary. Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass: `Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php"` ### Patches

    CVE: CVE-2026-44974

  • GHSA-jg4p-7fhp-p32pHigh
    @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
    • < 6.0.1
    GitHub (opens in a new tab)

    All versions of `@hapi/content` through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse `Content-Type` and `Content-Disposition` headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1. ### Impact Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value. ### Patches Fixed by tightening all three regular expressions to eliminate backtrackin

    CVE: CVE-2026-115728

  • GHSA-3wqh-h42r-x8fqHigh
    Denial of Service in @hapi/content
    • < 5.0.2
    GitHub (opens in a new tab)

    Versions of `@hapi/content` prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services. ## Recommendation Upgrade to version 5.0.2. Versions 4.1.1 and 5.0.1 are fixed but only avail

Showing 1-4 of 4 vulnerabilities