---
title: hapi DoS fixes: @hapi/content 6.0.3 (one multipart request can block Node for minutes) and joi 17.13.9 / 18.3.1 (email list whitespace) | ctxsec
url: https://ctxsec.com/items/hapi-content-joi-quadratic-regex-dos-cve-2026-119202-118772
description: "@hapi/content up to 6.0.2 parses Content-Disposition parameters in quadratic time, and hapi calls it on every multipart part before the route handler runs, so one unauthenticated request can block the Node.js event loop for minutes (CVE-2026-119202, CVSS 7.5, fixed in 6.0.3). joi's string().email({ multiple: true }) splits long whitespace runs in quadratic time (CVE-2026-118772, 7.5, fixed in 17.13.9 and 18.3.1; legacy @hapi/joi gets no fix)."
status: "official (hapijs GitHub advisories, Oct 30)"
published: 2026-11-01
---

> @hapi/content up to 6.0.2 parses Content-Disposition parameters in quadratic time, and hapi calls it on every multipart part before the route handler runs, so one unauthenticated request can block the Node.js event loop for minutes (CVE-2026-119202, CVSS 7.5, fixed in 6.0.3). joi's string().email({ multiple: true }) splits long whitespace runs in quadratic time (CVE-2026-118772, 7.5, fixed in 17.13.9 and 18.3.1; legacy @hapi/joi gets no fix).

[← Cybersecurity News](/news) · [markdown](/items/hapi-content-joi-quadratic-regex-dos-cve-2026-119202-118772.md)

official (hapijs GitHub advisories, Oct 30)

2026-11-01

### hapi DoS fixes: @hapi/content 6.0.3 (one multipart request can block Node for minutes) and joi 17.13.9 / 18.3.1 (email list whitespace)

The hapi.js project published two denial-of-service advisories, reviewed by GitHub on **Oct 30**:

- **@hapi/content CVE-2026-119202** (GHSA-8494-f6mr-cjpv, CVSS 7.5): `Content.disposition()` uses an unanchored global regex, so a parameter that is a long run of name characters without `=` is rescanned from every position. `@hapi/pez` calls it on every part of a `multipart/form-data` body on any route with `payload.multipart` enabled, **before** the handler and validation run. The only default limit is `payload.maxBytes` (1 MB), and the advisory says even a 64 KB token blocks the process for over a second. Affected: `content` 3.0.6 to 4.0.6 and `@hapi/content` up to 6.0.2. Fix: **6.0.3**. No workaround removes the risk.
- **joi CVE-2026-118772** (GHSA-4528-x5fx-h6hg, CVSS 7.5): `Joi.string().email({ multiple: true })` splits on `\s*[,]\s*`, which backtracks quadratically through long whitespace runs. The advisory says 100 KB of spaces blocks the event loop for several seconds. Fixed in **joi 17.13.9** and **18.3.1**; the deprecated `@hapi/joi` package (16.0.0 to 17.1.1) has no patched release.

**What to do:** update `@hapi/content` (usually transitive via `@hapi/subtext`/`@hapi/hapi`, so check your lockfile) and `joi`, migrate off `@hapi/joi`, and in the meantime set a low `payload.maxBytes` on multipart routes and cap the length of email-list fields before validation.

Sources: [hapijs/content advisory GHSA-8494-f6mr-cjpv (CVE-2026-119202)](https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv) · [hapijs/joi advisory GHSA-4528-x5fx-h6hg (CVE-2026-118772)](https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg)