npmPackage

@hapi/content

4 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-119202High 7.5
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
Affected: fixed in 6.0.3.
Fixed in 6.0.3 (released Oct 21, 2026, 8 days before disclosure).
The latest release, 6.0.3, is not affected.
74% of @hapi/content downloads last week were affected versions (1.8M).
CVE-2026-115728High 8.7
@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing
Affected: fixed in 6.0.1.
Fixed in 6.0.1 (released Apr 2, 2026, 204 days before disclosure).
The latest release, 6.0.3, is not affected.
45% of @hapi/content downloads last week were affected versions (1.1M).
CVE-2026-44974High 7.7
Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters
Affected: fixed in 6.0.2.
Fixed in 6.0.2 (released May 6, 2026, 72 days before disclosure).
The latest release, 6.0.3, is not affected.
47% of @hapi/content downloads last week were affected versions (1.1M).
CVE-2026-35213High 8.7
Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
Affected: fixed in 6.0.1.
Fixed in 6.0.1 (released Apr 2, 2026, 4 days before disclosure).
The latest release, 6.0.3, is not affected.
45% of @hapi/content downloads last week were affected versions (1.1M).