CVE-2026-35213: @hapi/content ReDoS DOS Vulnerability

CVE-2026-35213 Overview

CVE-2026-35213 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting @hapi/content, a widely-used Node.js package that provides HTTP Content-* headers parsing functionality. All versions of @hapi/content through 6.0.0 are vulnerable to this attack via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking, allowing attackers to cause application hangs or crashes.

Critical Impact

Attackers can exploit this vulnerability by sending specially crafted HTTP Content-Type or Content-Disposition headers to cause catastrophic regex backtracking, leading to complete denial of service of affected applications.

Affected Products

• @hapi/content versions through 6.0.0
• Applications using the hapi.js framework with vulnerable @hapi/content dependencies
• Node.js web applications parsing HTTP headers using affected @hapi/content versions

Discovery Timeline

• April 6, 2026 - CVE CVE-2026-35213 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35213

Vulnerability Analysis

This vulnerability falls under CWE-1333 (Inefficient Regular Expression Complexity). The @hapi/content package utilizes three regular expressions to parse Content-Type and Content-Disposition HTTP headers. These patterns contain constructs that are susceptible to catastrophic backtracking when processing maliciously crafted input strings.

ReDoS vulnerabilities occur when a regular expression engine enters an exponential-time matching state due to nested quantifiers or overlapping alternations. In the context of HTTP header parsing, an attacker can craft header values that trigger worst-case regex evaluation time, effectively freezing the Node.js event loop and rendering the application unresponsive.

The network-accessible nature of this vulnerability makes it particularly concerning for internet-facing applications, as no authentication or special privileges are required to exploit it.

Root Cause

The root cause lies in inefficient regular expression patterns within the @hapi/content parsing logic. The regex constructs used to validate and extract values from Content-Type and Content-Disposition headers contain patterns with exponential time complexity under certain input conditions. When specially crafted header strings are processed, the regex engine attempts numerous backtracking operations, consuming excessive CPU resources and blocking the event loop.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can send HTTP requests with maliciously crafted Content-Type or Content-Disposition header values to any application using the vulnerable @hapi/content package. When the application attempts to parse these headers, the regex engine enters a pathological state, causing the Node.js process to hang.

The attack is straightforward to execute—an attacker simply needs to craft header values with specific character patterns that trigger catastrophic backtracking in the vulnerable regex patterns. A single malicious request can tie up the event loop, causing denial of service for all concurrent users.

Detection Methods for CVE-2026-35213

Indicators of Compromise

• Sudden spikes in CPU utilization on Node.js application servers without corresponding increases in legitimate traffic
• Application unresponsiveness or timeout errors reported by users or monitoring systems
• HTTP requests with abnormally long or malformed Content-Type or Content-Disposition header values in access logs
• Event loop delays or blocked event loop warnings in Node.js application performance monitoring

Detection Strategies

• Implement dependency scanning to identify @hapi/content versions 6.0.0 and below in your application's dependency tree
• Deploy Web Application Firewall (WAF) rules to detect and block HTTP requests with unusually long or suspicious Content-Type and Content-Disposition header values
• Monitor Node.js event loop lag metrics to detect potential ReDoS exploitation attempts
• Review application logs for requests with malformed or excessively complex header values

Monitoring Recommendations

• Configure alerts for sustained high CPU usage on application servers running Node.js workloads
• Implement request timeout mechanisms to prevent long-running regex operations from blocking the event loop indefinitely
• Use runtime application self-protection (RASP) solutions to detect and block ReDoS attack patterns
• Enable detailed logging of HTTP headers for forensic analysis of potential attack attempts

How to Mitigate CVE-2026-35213

Immediate Actions Required

• Update @hapi/content to version 6.0.1 or later immediately to address this vulnerability
• Audit your application's package-lock.json or yarn.lock files to identify all instances of @hapi/content in your dependency tree
• Implement input validation to reject HTTP requests with excessively long Content-Type or Content-Disposition headers at the edge (load balancer or WAF)
• Consider implementing request timeouts to limit the impact of potential ReDoS attacks during the patching window

Patch Information

The vulnerability is fixed in @hapi/content version 6.0.1. The fix addresses the inefficient regular expression patterns that caused catastrophic backtracking. For technical details about the fix, refer to the GitHub Pull Request and the GitHub Security Advisory.

Workarounds

• Implement header length limits at the reverse proxy or load balancer level to reject requests with excessively long Content-Type or Content-Disposition headers
• Deploy WAF rules to sanitize or block requests containing header patterns known to trigger ReDoS
• Consider using alternative header parsing libraries until patching is complete, though upgrading to the patched version is strongly recommended

# Update @hapi/content to the patched version
npm update @hapi/content

# Or explicitly install the fixed version
npm install @hapi/content@6.0.1

# Verify the installed version
npm list @hapi/content