https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T10:19:08.785477+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/ghsa-jg4p-7fhp-p32p GHSA-jg4p-7fhp-p32p — @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing 2026-10-01T10:19:08.789778+00:00

Affected: npm: @hapi/content

All versions of `@hapi/content` through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse `Content-Type` and `Content-Disposition` headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1.

### Impact

Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value.

### Patches

Fixed by tightening all three regular expressions to eliminate backtracking.

### Workarounds

There are no known workarounds. Upgrade to the patched version.