The hapi.js project published two denial-of-service advisories, reviewed by GitHub on Oct 30:

• @hapi/content CVE-2026-119202 (GHSA-8494-f6mr-cjpv, CVSS 7.5): Content.disposition() uses an unanchored global regex, so a parameter that is a long run of name characters without = is rescanned from every position. @hapi/pez calls it on every part of a multipart/form-data body on any route with payload.multipart enabled, before the handler and validation run. The only default limit is payload.maxBytes (1 MB), and the advisory says even a 64 KB token blocks the process for over a second. Affected: content 3.0.6 to 4.0.6 and @hapi/content up to 6.0.2. Fix: 6.0.3. No workaround removes the risk.
• joi CVE-2026-118772 (GHSA-4528-x5fx-h6hg, CVSS 7.5): Joi.string().email({ multiple: true }) splits on \s*[,]\s*, which backtracks quadratically through long whitespace runs. The advisory says 100 KB of spaces blocks the event loop for several seconds. Fixed in joi 17.13.9 and 18.3.1; the deprecated @hapi/joi package (16.0.0 to 17.1.1) has no patched release.

What to do: update @hapi/content (usually transitive via @hapi/subtext/@hapi/hapi, so check your lockfile) and joi, migrate off @hapi/joi, and in the meantime set a low payload.maxBytes on multipart routes and cap the length of email-list fields before validation.