npm content vulnerabilities

Latest npm content CVEs

Newest publication first

1. CVE-2026-119202 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

   Published 2026-10-29

   High·CVSS 7.5 EPSS 0.41%

   @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter con...

2. GHSA-5854-jvxx-2cg9 Denial of Service in content

   Published 2020-09-03

   Unknown

   Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expec...

3. CVE-2017-16111 Regular Expression Denial of Service in content

   Published 2018-06-07

   High·CVSS 7.5 EPSS 1.1%

   The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.