Executive brief
@hapi/content is a utility library used by the Hapi web framework to process HTTP headers. A vulnerability in how it handles specific headers allows an attacker to crash or freeze the server by sending a single, specially crafted web request. This results in a denial-of-service (DoS) condition, making the application unavailable to legitimate users.
Technical details
The @hapi/content library contains three regular expressions used for parsing 'Content-Type' and 'Content-Disposition' headers that are susceptible to catastrophic backtracking (CWE-1333). An unauthenticated remote attacker can exploit this by sending a crafted HTTP request containing a malicious header value. Because Node.js is single-threaded, the resulting CPU exhaustion causes the event loop to block, leading to a complete process hang or denial of service. The issue is resolved in version 6.0.1 by tightening the regex patterns to eliminate inefficient backtracking.
Affected products
- hapijs content <= 6.0.0
Timeline
- 2026-04-02: patched: Fix merged in pull request #38 and version 6.0.1 released
- 2026-04-02: advisory: GitHub Security Advisory GHSA-jg4p-7fhp-p32p published
- 2026-04-06: disclosed: CVE-2026-35213 published to NVD