https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 22:29:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-119202 <p>@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.</p> <p>@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-119202 https://db.gcve.eu/vuln/ghsa-8494-f6mr-cjpv <p><strong>Affected:</strong> npm: @hapi/content, npm: content</p> <p>### Summary</p> <p>`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.</p> <p>### Details</p> <p>`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:</p> <p>```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;&#39;&#34;\s]+\&#39;[\w-]*\&#39;[^;\s]+)|(?:\&#34;([^&#34;]*)\&#34;)|([^;\s]*))/g ```</p> <p>The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.</p> <p>`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.</p> <p>The fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear.</p> <p>```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;&#39;&#34;\s]+\&#39;[\w-]*\&#39;[^;\s]+)|(?:\&#34;([^&#34;]*)\&#34;)|([^;\s]*))|[^\=\*\s]+/g ```</p> <p>Every re…</p> <p><strong>Affected:</strong> npm: @hapi/content, npm: content</p> <p>### Summary</p> <p>`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.</p> <p>### Details</p> <p>`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:</p> <p>```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;&#39;&#34;\s]+\&#39;[\w-]*\&#39;[^;\s]+)|(?:\&#34;([^&#34;]*)\&#34;)|([^;\s]*))/g ```</p> <p>The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.</p> <p>`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.</p> <p>The fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear.</p> <p>```js /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;&#39;&#34;\s]+\&#39;[\w-]*\&#39;[^;\s]+)|(?:\&#34;([^&#34;]*)\&#34;)|([^;\s]*))|[^\=\*\s]+/g ```</p> <p>Every re…</p> https://db.gcve.eu/vuln/ghsa-8494-f6mr-cjpv