@hapi/content regex flaw in Content.disposition() (EUVD-2026-113373)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- hapi
- Product
- @hapi/content
- First seen
Summary
Per the EUVD listing, @hapi/content versions 3.0.6 through 6.0.3 use an unanchored regular expression in Content.disposition() that can cause repeated failed matching on crafted Content-Disposition headers. The listing assigns a CVSS v3.1 score of 7.5.
If you use hapi
Upgrade @hapi/content to version 6.0.4 or later
Limit or validate Content-Disposition header length at the edge
Upgrade @hapi/content to 6.0.3 or later
Review code that passes untrusted input to Content.disposition()
Monitor for unusually slow requests to affected endpoints
What the sources say 2
· Mastodon: “From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Di” Source
· Mastodon: “From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a ...” Source