Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The two parsers resolved duplicates inconsistently and silently: - Content.disposition() retained the last occurrence of each parameter. - Content.type() retained the first occurrence of charset and boundary. Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass: Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php" Patches The issue has been patched in 6.0.2. Workarounds Pre or post validate headers looking for duplicates. Resources - RFC 6266 §4.1 — Content-Disposition syntax - RFC 7231 §3.1.1.1 — Content-Type syntax - RFC 7230 §3.2.6 — token character set
Recommended action: Upgrade to 6.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1. Impact Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value. Patches Fixed by tightening all three regular expressions to eliminate backtracking. Workarounds There are no known workarounds. Upgrade to the patched version.
Recommended action: Upgrade to 6.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of @hapi/content prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services. Recommendation Upgrade to version 5.0.2. Versions 4.1.1 and 5.0.1 are fixed but only available for direct download through the repository.
Recommended action: Upgrade to 5.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.