Approved changes feed: RSS · Atom
cpe:2.3:a:hapijs:content:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hapijs (cde07e56-6e3e-5211-9d96-925613bfc13f) |
|---|---|
| Product | Content (ea371d3b-f5ee-5757-9cc6-8b910698cd59) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44974 |
vulnerable | 2026-07-29 00:52:14.961355 |
Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters
@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.
Published: 2026-07-17T20:11:44.250Z
Updated: 2026-07-21T02:16:04.352Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35213 |
vulnerable | 2026-06-08 07:59:13.724647 |
Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1.
Published: 2026-04-06T20:08:54.811Z
Updated: 2026-06-23T15:51:14.160Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.