Description
Content.disposition() takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 3.0.6, <= 4.0.6
References
Could your website be exposed too?
SmartScanner can check your website for @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service - @hapi/joi - CVE-2026-118772
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - CVE-2026-111766
- joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service - CVE-2026-118772
- Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters - CVE-2026-101896
You might also like:
See something that needs correcting? Let us knowUpdated October 30, 2026