@hapi/content vulnerabilities

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

Vulnerability in the @hapi/content library (versions before 6.0.2) for parsing HTTP Content-* headers. Different handling of duplicate parameters can lead to parameter smuggling and bypass of filename allowlists.

The @hapi/content library through version 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.