Zero Radar
← feed
HighVulnerabilityCVE-2026-119202updated 30 Oct 2026, 23:10 UTC

hapi multipart uploads can freeze a Node.js server

A specially crafted upload with a very long header value can make a Node.js server stop responding for a long time. Anyone who can send a request to the server can do this without logging in.

Fixed in @hapi/content 6.0.3 · out Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes@hapi/content 6.0.3 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends uploadMultipart request with a long unbroken token
  2. 2Request reaches serverHapi route accepts multipart payload
  3. 3Header parsedContent.disposition() scans input repeatedly
  4. 4Event loop blockedNode.js stops handling other requests
  5. ResultServer stops responding to users

What happened

In @hapi/content, Content.disposition() parses Content-Disposition parameters with an unanchored regular expression, so a long token without '=' causes quadratic-time matching that blocks the Node.js event loop.

Why it is dangerous: A single unauthenticated multipart request can block the whole process for minutes, causing denial of service for every user of the application.

Are you affected?

You are affected if your app uses @hapi/content 3.0.6 through 6.0.2 (or content 3.0.6 through 4.0.6), including hapi routes with payload.multipart enabled that accept multipart/form-data.

Package / productAffected versionsFixed in
@hapi/content · npm<= 6.0.26.0.3
content · npm>= 3.0.6, <= 4.0.6no fix yet

What to do

  1. Update @hapi/content to 6.0.3 or later
  2. Check whether your hapi routes accept multipart payloads and whether they depend on the vulnerable content package
  3. Until the upgrade, set a low payload.maxBytes on multipart routes to reduce the delay per request

Timeline

  1. 29 Oct 2026, 21:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 21:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 21:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:10 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:10 UTC
    Fixed version published: @hapi/content 6.0.3 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119202 · GHSA-8494-f6mr-cjpv
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 21:17 UTC
On Zero Radar
29 Oct 2026, 21:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:10 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

hapi multipart uploads can freeze a Node.js server · Zero Radar