CVE-2026-35213 | hapijs content up to 6.0.0 HTTP Content-Type/Content-Disposition redos

A vulnerability described as problematic has been identified in hapijs content up to 6.0.0. Impacted is an unknown function of the component HTTP Handler. The manipulation of the argument Content-Type/Content-Disposition results in inefficient regular expression complexity.

This vulnerability was named CVE-2026-35213. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.