GHSA-jg4p-7fhp-p32p
High · 7.5CVSS
7.5
EPSS
—
Published
Apr 4, 2026
CISA due date
—
The record
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hapi/content | 0 | 6.0.1 |
Related vulnerabilities
- CVE-2026-35213 @hapi/content provided HTTP Content-* headers parsing. Same vulnerability
- GHSA-36hh-x5p5-jgc8 @hapi/content header parser has a parameter smuggling issue that allows upload-filter… Also affects @hapi/content
- CVE-2026-44974 @hapi/content header parser has a parameter smuggling issue that allows upload-filter… Also affects @hapi/content
- GHSA-3wqh-h42r-x8fq Denial of Service in @hapi/content Also affects @hapi/content
- CVE-2026-112901 Pillow is a Python imaging library. CWE-1333
- CVE-2026-106454 Twisted is an event-based framework for internet applications, supporting Python 3.6+. CWE-1333
- CVE-2026-77387 geopy is a geocoding library for Python. CWE-1333
- CVE-2026-102990 basic-ftp is an FTP client for Node.js. CWE-1333