Threats tagged 'ghsa-8494-f6mr-cjpv'

A denial of service vulnerability exists in @hapi/content versions prior to 6.0.3 due to quadratic-time parsing of Content-Disposition parameters. An unauthenticated attacker can send a multipart/form-data request with a long token lacking an '=' character, causing the Node.js event loop to block for several seconds to minutes. This affects hapi servers with multipart payload routes and applications using Content.disposition() on untrusted headers. The issue is fixed in version 6.0.3.