HTTP Header Parsing Vulnerability in @hapi/content Affects Node.js Applications

CVE-2026-119202

What is CVE-2026-119202?

A critical issue in @hapi/content versions 3.0.6 through 6.0.3 exists that affects the HTTP Content-Disposition header parsing. This vulnerability occurs due to an unanchored parameter-name expression utilized in a global regular-expression scan, which leads to inefficient processing of content headers. When a Content-Disposition parameter contains a lengthy token without an equals sign, it can result in repeated failed matches and potentially block the Node.js event loop. This issue is particularly concerning for applications processing multipart/form-data headers, especially on unauthenticated hapi routes with payload.multipart enabled. Developers are urged to update to @hapi/content version 6.0.3 or higher to mitigate this vulnerability.

References