{"id":"CVE-2026-119202","kind":"vulnerability","aliases":["CVE-2026-119202"],"related":[],"title":"@hapi/content: crafted Content-Disposition header can block Node.js event loop","description":"@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.","summary":"A crafted Content-Disposition header with a long token and no equals sign makes @hapi/content's parser run in quadratic time. The Node.js event loop stalls, so the server stops answering other requests.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hapi","multipart-uploads","node.js","npm","package"],"not_affected_if":["no-multipart-parsing","versions-outside-range"],"how_to_check":null,"fix":"- @hapi/content: upgrade to `6.0.3`","status":"open","published_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:34+00:00","updated_at":"2026-10-29T21:28:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T21:28:34Z","model":"claude-haiku-5-5","output":{"fix":"- @hapi/content: upgrade to `6.0.3`","reach":"internet","title":"@hapi/content: crafted Content-Disposition header can block Node.js event loop","impact":"low","summary":"A crafted Content-Disposition header with a long token and no equals sign makes @hapi/content's parser run in quadratic time. The Node.js event loop stalls, so the server stops answering other requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["hapi","node.js","multipart-uploads","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Node.js event loop blocks, causing denial of service","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @hapi/content`; affected range is `3.0.6` through `6.0.2`.\n- Look for hapi routes with `payload.multipart` enabled that parse multipart/form-data through @hapi/pez.\n- Look for code that passes untrusted headers directly to `Content.disposition()`.","plain_action":"","needs_analyst":false,"not_affected_if":["no-multipart-parsing","versions-outside-range"],"who_is_affected":"Applications using @hapi/content from 3.0.6 up to 6.0.2 are exposed. The risk is highest for unauthenticated hapi routes with multipart payload parsing enabled, since @hapi/pez calls the vulnerable code before route handlers or validation run. Applications that never parse multipart uploads or untrusted Content-Disposition headers can deprioritize it, but should still upgrade.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4234,"output_tokens":586,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119202':14A,17A '-2026':13A,16A '3.0.6':66C '6.0.3':68C,151C 'affect':135C 'also':134C 'answer':56B 'applic':136C 'block':8A,111C 'caus':84C 'contain':98C 'content':4A,28B,62C,95C 'content-disposit':3A,27B,94C 'content.disposition':69C,143C 'craft':2A,26B 'cve':12A,15A 'direct':141C 'disposit':5A,29B,96C 'enabl':132C 'equal':37B,104C 'event':10A,49B,114C 'express':76C,82C 'fail':86C 'fix':147C 'global':79C 'handler':118C 'hapi':18B,128C 'hapi/content':1A,40B,59C,149C 'hapi/pez':122C 'header':6A,30B,63C,125C,140C 'http':61C 'includ':126C 'input':91C 'issu':145C 'long':33B,100C 'loop':11A,50B,115C 'make':39B 'match':87C 'multipart':20B 'multipart-upload':19B 'multipart/form-data':124C 'name':75C 'node.js':9A,22B,48B,113C 'npm':23B 'packag':24B 'paramet':74C,97C 'parameter-nam':73C 'pars':64C,123C 'parser':42B 'pass':138C 'payload.multipart':131C 'process':109C 'provid':60C 'quadrat':45B,108C 'regular':81C 'regular-express':80C 'remain':90C 'repeat':85C 'request':58B 'result':107C 'rout':117C,129C 'run':43B 'scan':83C 'server':54B 'sign':38B,105C 'stall':51B 'stop':55B 'time':46B 'token':34B,101C 'unanchor':72C 'unauthent':127C 'untrust':139C 'upload':21B 'use':70C 'valid':120C 'version':150C 'without':102C","nicknames":[],"mitigations":[],"who_affected":"Applications using @hapi/content from 3.0.6 up to 6.0.2 are exposed. The risk is highest for unauthenticated hapi routes with multipart payload parsing enabled, since @hapi/pez calls the vulnerable code before route handlers or validation run. Applications that never parse multipart uploads or untrusted Content-Disposition headers can deprioritize it, but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119202","severity":null,"published_at":"2026-10-29T21:17:19+00:00","modified_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}