CVE-2026-35213 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
Attackers can cause denial of service in applications using @hapi/content by sending crafted HTTP headers that trigger catastrophic regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35213?
CVE-2026-35213 is a high-severity denial of service vulnerability in hapijs content, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1.
Weakness: CWE-1333
Which versions are affected by CVE-2026-35213?
It affects 1 product.
Products include Content Project Content.
How do I fix CVE-2026-35213?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-35213 being exploited?
There is no known exploitation of CVE-2026-35213 in the wild and no public exploit code.
Other vulnerabilities in hapijs content
Sources
Also known as CLEANSTART-2026-OG82185, MINI-5r6h-q74x-whh3, MINI-96w2-mm4g-jp88, MINI-cj6p-w63h-hfq6, MINI-grmg-7ghx-v2rp, MINI-h32j-r6pw-h8wf and 7 more.