GHSA-3wqh-h42r-x8fq

What it actually does

The flaw permits specially crafted HTTP content-type headers or payloads to trigger excessive resource consumption or unhandled exceptions during parsing, resulting in service unavailability.

Why it matters to the business

Service outages interrupt application availability, degrade user experience, and require emergency response resources; the vulnerability has been public for over six years with no known in-the-wild exploitation.

How an attack unfolds

An unauthenticated attacker sends a crafted request containing a malicious content-type header or body to an application using the vulnerable @hapi/content parser; the parser enters an expensive or crashing code path and the server becomes unresponsive to legitimate traffic.

How to fix it

Upgrade @hapi/content to version 5.0.2 or later; for Alpaquita stream users, update to nodejs 20.11.1-r0 or newer packages that incorporate the fixed dependency.

How to confirm the fix worked

Inventory installed versions of @hapi/content across all Node.js projects and confirm none remain below 5.0.2; perform functional testing with known-good content-type headers after upgrade.

Typical attack path

1. Identify an endpoint that processes incoming HTTP requests with content negotiation
2. Craft a request containing a malformed or pathological content-type value
3. Send the request to the target server
4. Observe server CPU/memory exhaustion or process termination
5. Repeat to sustain denial of service

How to detect it

Review web server access and error logs for sudden spikes in requests with unusual content-type headers around the time of any outage; correlate with process termination or high CPU events in application logs.

What your security team should do

• Prioritize upgrade of @hapi/content to 5.0.2 in all production and staging environments
• Add dependency version pinning and automated scanning to prevent future regressions
• Review any custom content-type parsing logic for similar denial-of-service patterns