{"items":[{"id":"NVI-00009070","kind":"vulnerability","title":"@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-8494-f6mr-cjpv","CVE-2026-119202"],"plain_summary":"GitHub lists this reviewed advisory for @hapi/content, content. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-07bf9cb90e02e4614bf517ebc7f1ccfc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.0.3 for @hapi/content. Confirm the publisher’s latest guidance.","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:10:15.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-9c5120957a47a7bb2c8481081d889de3"},{"kind":"CVSS","as_of":"2026-10-30T19:39:14.897Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-5b07f7012e32bbf6b2055a746b3a6898"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.411%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.35414. Missing scores are unknown.","source_id":"sr-07bf9cb90e02e4614bf517ebc7f1ccfc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9c5120957a47a7bb2c8481081d889de3","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8494-f6mr-cjpv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-0f15f507ecb05afb13134a61199e9554","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-8494-f6mr-cjpv","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-01T00:59:26.257Z"},{"id":"sr-5b07f7012e32bbf6b2055a746b3a6898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119202","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-119202","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:16.598Z"},{"id":"sr-07bf9cb90e02e4614bf517ebc7f1ccfc","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119202","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.269Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"@hapi/content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["<= 6.0.2"]},{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":[">= 3.0.6, <= 4.0.6"]},{"certainty":"source_listed","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"technology":"@hapi/content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["SEMVER: introduced 0; fixed 6.0.3"]},{"certainty":"source_listed","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"technology":"content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["SEMVER: introduced 3.0.6; last_affected 4.0.6"]}],"null_published_at":"2026-11-07T07:07:42.457Z","source_updated_at":"2026-10-30T23:10:15.000Z","source_disclosed_at":"2026-10-30T23:10:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00009070","kind":"vulnerability","title":"@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8494-f6mr-cjpv","CVE-2026-119202"],"plain_summary":"GitHub lists this reviewed advisory for @hapi/content, content. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-07bf9cb90e02e4614bf517ebc7f1ccfc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.0.3 for @hapi/content. Confirm the publisher’s latest guidance.","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:10:15.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-9c5120957a47a7bb2c8481081d889de3"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.411%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.35414. Missing scores are unknown.","source_id":"sr-07bf9cb90e02e4614bf517ebc7f1ccfc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9c5120957a47a7bb2c8481081d889de3","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8494-f6mr-cjpv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-0f15f507ecb05afb13134a61199e9554","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-8494-f6mr-cjpv","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-01T00:59:26.257Z"},{"id":"sr-07bf9cb90e02e4614bf517ebc7f1ccfc","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119202","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.269Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"@hapi/content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["<= 6.0.2"]},{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":[">= 3.0.6, <= 4.0.6"]},{"certainty":"source_listed","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"technology":"@hapi/content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["SEMVER: introduced 0; fixed 6.0.3"]},{"certainty":"source_listed","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"technology":"content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["SEMVER: introduced 3.0.6; last_affected 4.0.6"]}],"null_published_at":"2026-11-02T20:21:07.830Z","source_updated_at":"2026-10-30T23:10:15.000Z","source_disclosed_at":"2026-10-30T23:10:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00009070","kind":"vulnerability","title":"@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8494-f6mr-cjpv","CVE-2026-119202"],"plain_summary":"GitHub lists this reviewed advisory for @hapi/content, content. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.0.3 for @hapi/content. Confirm the publisher’s latest guidance.","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:10:15.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-9c5120957a47a7bb2c8481081d889de3"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9c5120957a47a7bb2c8481081d889de3","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8494-f6mr-cjpv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-0f15f507ecb05afb13134a61199e9554","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-8494-f6mr-cjpv","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-01T00:59:26.257Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"@hapi/content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["<= 6.0.2"]},{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":[">= 3.0.6, <= 4.0.6"]},{"certainty":"source_listed","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"technology":"@hapi/content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["SEMVER: introduced 0; fixed 6.0.3"]},{"certainty":"source_listed","source_ids":["sr-0f15f507ecb05afb13134a61199e9554"],"technology":"content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["SEMVER: introduced 3.0.6; last_affected 4.0.6"]}],"null_published_at":"2026-11-01T01:03:56.577Z","source_updated_at":"2026-10-30T23:10:15.000Z","source_disclosed_at":"2026-10-30T23:10:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00009070","kind":"vulnerability","title":"@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8494-f6mr-cjpv","CVE-2026-119202"],"plain_summary":"GitHub lists this reviewed advisory for @hapi/content, content. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:10:15.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-9c5120957a47a7bb2c8481081d889de3"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9c5120957a47a7bb2c8481081d889de3","url":"https://github.com/advisories/GHSA-8494-f6mr-cjpv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8494-f6mr-cjpv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"@hapi/content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":["<= 6.0.2"]},{"certainty":"source_listed","source_ids":["sr-9c5120957a47a7bb2c8481081d889de3"],"technology":"content","known_exclusions":[],"conditions_summary":"### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and","public_affected_ranges":[">= 3.0.6, <= 4.0.6"]}],"null_published_at":"2026-10-31T22:13:31.273Z","source_updated_at":"2026-10-30T23:10:15.000Z","source_disclosed_at":"2026-10-30T23:10:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:55:49.621Z"}],"next_cursor":null,"snapshot_revision":"39771"}