Package vulnerability, severity high

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Published October 30, 2026, updated October 31, 2026

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service. Source: GHSA-8494-f6mr-cjpv (CVE-2026-119202).

What's affected

• @hapi/content (npm)<6.0.3
• content (npm)>=3.0.6 <=4.0.6

What to do

1. Upgrade @hapi/content to 6.0.3 or later.
2. No fixed version of content yet: see the advisory for workarounds.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-8494-f6mr-cjpv

References

• https://osv.dev/vulnerability/GHSA-8494-f6mr-cjpv
• https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv
• https://nvd.nist.gov/vuln/detail/CVE-2026-119202
• https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd
• https://github.com/hapijs/content
• https://github.com/hapijs/content/releases/tag/v6.0.3

Notice ghsa-8494-f6mr-cjpv, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.