ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-119202

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · @hapi/content: quadratic-time parsing of

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119202. EPSS is 0.41%. Act only if a listed version of @hapi/content: quadratic-time parsing of is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (@hapi/content: quadratic-time parsing of).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.41%
Remediation
Version ranges on file
Affected products
npm @hapi · npm @hapi/content · npm content

### Summary takes quadratic time when a parameter contains a long token without . One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details reads the parameters with a global regular expression in : The parameter name part has no anchor. When a run of name characters has no after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length. calls on the header of every part in a body. In hapi, this occurs on each route with enabled, before the route handler and before any validation. The only size limit is the route , which is 1 MB by default. The fix adds an alternative that matches the full run of name characters when no follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear. Every release from (published as ) up to and including is affected. Workarounds: none that removes the risk, upgrade required. To reduce the delay for each request until you upgrade, set a low on routes that accept multipart payloads. A token of 64 KB still blocks the process for more than 1 second. ### Proof of concept Install with , then run: With , the time increases by approximately four for each doubling of the token. During each request, the server does not answer other clients: The reporter measured 542 seconds for a token of 1,024,000 bytes, which is near the default . With : ### Impact This is a denial of service through slow regular expression processing. It affects every hapi server with a route that accepts multipart payloads, and every application that gives untrusted headers to . An unauthenticated attacker sends one upload request of normal size, and the Node.js process stops answering all clients for seconds to mi

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @hapiversion unspecified
  • npm @hapi/content<6.0.3
  • npm @hapi/content<= 6.0.2
  • npm content>= 3.0.6, <= 4.0.6

How to fix CVE-2026-119202

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119202. EPSS is 0.41%. Act only if a listed version of @hapi/content: quadratic-time parsing of is installed.

Which versions are affected?

Compare what you have installed with <6.0.3, <= 6.0.2, >= 3.0.6, <= 4.0.6. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1333: Inefficient Regular Expression Complexity. EPSS 0.41%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary takes quadratic time when a parameter contains a long token without . One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details reads the parameters with a global regular expression in : The parameter name part has no anchor. When a run of name characters has no after it, the match attempt reads the full run and fails. The global scan then

  2. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary takes quadratic time when a parameter contains a long token without . One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details reads the parameters with a global regular expression in : The parameter name part has no anchor. When a run of name characters has no after it, the match attempt reads the full run and fails. The global scan then

Sources

  • CVE.orgVulnerability recordCVE-2026-119202

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-8494-f6mr-cjpv

    @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119202

    Content.disposition() takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes.

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorynpm/@hapi/content/CVE-2026-119202.yml

    takes quadratic time when a + parameter contains a long token without . One unauthenticated multipart request + can block the Node.js event loop for several minutes." +date: "2026-10-30" +pubdate: "2026-10-30" +affected_range: "<6.0.3" +fixed_versions: +- "6.0.3" +affected_versions: "All versions before 6.0.3" +not_impacted: "All versions starting from 6.0.3" +solution: "Upgrade to version 6.0.3 o

    gitlab.com

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseNov 7, 2026
  • GitLab Advisory DatabaseNov 6, 2026
  • GitLab Advisory DatabaseNov 1, 2026
  • CVE.orgOct 31, 2026