# hapi @hapi/content denial of service in HTTP header parser

Source: https://junglewise.ai/threats/hapi-hapi-content-denial-of-service-in-http-header-parser-d6ae9a5f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-03. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

Severity: info · CVSS 7.5 · Published 2020-09-03

A vulnerability in a core component of the hapi web framework could allow an attacker to crash a web server by sending a specially crafted web request. This component is responsible for processing how data is encoded during transmission. If exploited, this could lead to a complete service outage, disrupting business operations and customer access.

Technologies: [Hapi Content](https://junglewise.ai/threats/technologies/content), [@hapi/content (npm)](https://junglewise.ai/threats/technologies/hapi-content). Vendors: [Hapi](https://junglewise.ai/threats/vendors/hapi), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 7.5, published 3 September 2020.

**Which products and versions are affected?** Hapi Content < 4.1.1, < 5.0.1; @hapi/content (npm) SEMVER:introduced=0,fixed=5.0.2.

**Is there a fix for This vulnerability?** Yes. @hapi/content (npm): upgrade to 5.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Hapi Content or @hapi/content (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hapi/content (npm): upgrade to 5.0.2 or later

  ```sh
  npm install @hapi/content@5.0.2
  ```


## Technical details

The @hapi/content library, used for parsing HTTP Content-Type and Content-Encoding headers, contains a flaw in its header parsing logic. When processing a Content-Encoding header with certain invalid values, the parser throws a system error rather than a catchable application error. Because the hapi framework rethrows system errors up the stack, an unhandled exception occurs, leading to process termination. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP request, resulting in a Denial of Service (DoS). The issue is resolved in versions 4.1.1, 5.0.1, and 5.0.2.

## Affected products

- hapi @hapi/content < 4.1.1, < 5.0.1

## Timeline

- 2020-08-31: other: GitHub reviewed the advisory
- 2020-09-03: disclosed: Advisory published

## References

- [https://www.npmjs.com/advisories/1476](https://www.npmjs.com/advisories/1476)

## Related threats

- [@hapi/content ReDoS in Content-Disposition parsing](https://junglewise.ai/threats/cve-2026-119202-hapi-content-provides-http-content-header-parsing-from-3-0-6)
- [hapijs @hapi/content parameter smuggling in header parsing](https://junglewise.ai/threats/cve-2026-44974-hapijs-hapi-content-parameter-smuggling-in-header-parsing)
- [hapijs @hapi/content ReDoS in HTTP header parsing](https://junglewise.ai/threats/cve-2026-35213-hapijs-hapi-content-redos-in-http-header-parsing)