Executive Summary

The vulnerability exists in the @hapi/content package versions up to 6.0.0, which handles parsing of HTTP Content-* headers. It is a Regular Expression Denial of Service (ReDoS) vulnerability caused by three regular expressions used to parse Content-Type and Content-Disposition headers. These regular expressions contain patterns that can lead to catastrophic backtracking when processing crafted HTTP header values, allowing an attacker to cause a denial of service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by an attacker sending specially crafted HTTP headers that trigger the vulnerable regular expressions to perform excessive backtracking. This can cause the application using @hapi/content to consume excessive CPU resources, leading to degraded performance or denial of service, potentially making the service unavailable to legitimate users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade @hapi/content to version 6.0.1 or later, where the Regular Expression Denial of Service (ReDoS) issue has been fixed.

Useful 0 Not Useful 0