CVE-2026-119202: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Severity: high. ### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details `Content.disposition()` reads the parameters with a global reg

Читать первоисточник →