CVE-2026-35213

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-352148.7Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the CVE-2026-352157.5Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does CVE-2026-352169.0Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) o CVE-2026-352176.5NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscrip CVE-2026-352188.7Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, view CVE-2026-352197.1Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts,CVE-2026-352204.3Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.CVE-2026-352219.8Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.CVE-2026-352229.8Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.CVE-2026-352239.8An improper access check allows unauthorized access to com_config webservice endpoints.CVE-2026-352258.7An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing leg CVE-2026-352266.5An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to se