| Package | Affected versions | Patched versions |
|---|---|---|
| @hapi/content | < 6.0.1 | 6.0.1 |
All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This has been fixed in v6.0.1.
Denial of Service. An unauthenticated remote attacker can cause a Node.js process to become unresponsive by sending a single HTTP request with a maliciously crafted header value.
Fixed by tightening all three regular expressions to eliminate backtracking.
There are no known workarounds. Upgrade to the patched version.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free