平台
nodejs
组件
@hapi/content
修复版本
6.0.2
6.0.1
CVE-2026-35213 是 @hapi/content 库中的一个正则表达式拒绝服务 (ReDoS) 漏洞。所有 6.0.0 及更早版本的 @hapi/content 都存在此漏洞，攻击者可以通过构造恶意的 HTTP 头部值来触发 ReDoS 攻击。用于解析 Content-Type 和 Content-Disposition 头部的三个正则表达式包含容易发生灾难性回溯的模式。攻击者可以通过发送包含恶意头部值的 HTTP 请求导致 Node.js 进程无响应，从而造成拒绝服务。此问题已在 6.0.1 版本中修复。
An attacker can exploit this vulnerability by sending a single, maliciously crafted HTTP request containing specially designed header values. These headers trigger catastrophic backtracking within the vulnerable regular expressions used by @hapi/content to parse Content-Type and Content-Disposition headers. This leads to excessive CPU consumption and effectively freezes the Node.js process, resulting in a denial of service. The attack requires no authentication, making it easily exploitable. The blast radius is limited to the affected Node.js process, but widespread deployments could experience significant disruption.
This vulnerability is not currently listed on KEV or EPSS. The CVSS score of 7.5 indicates a HIGH probability of exploitation if the vulnerability is exposed. Public proof-of-concept (POC) code is likely to emerge given the ease of exploitation and the ReDoS nature of the vulnerability. The vulnerability was published on 2026-04-04, so active exploitation campaigns are possible.
漏洞利用状态
EPSS
0.25% (49% 百分位)
CISA SSVC
The primary mitigation is to upgrade to @hapi/content version 6.0.1 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to filter out requests with suspicious header values. Implement strict header validation logic in your application to reject requests with malformed or overly complex headers. Specifically, limit the length and complexity of Content-Type and Content-Disposition header values. After upgrading, confirm the fix by sending a test request with a known malicious header and verifying that the Node.js process remains responsive.
Actualiza la librería @hapi/content a la versión 6.0.1 o superior para mitigar la vulnerabilidad de ReDoS en el análisis de encabezados HTTP. Esta actualización corrige las expresiones regulares susceptibles a backtracking catastrófico en los encabezados Content-Type y Content-Disposition.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2026-35213 是 @hapi/content 库中的一个正则表达式拒绝服务 (ReDoS) 漏洞，攻击者可以通过构造恶意的 HTTP 头部值来触发该漏洞。
如果您的项目使用了 6.0.0 及更早版本的 @hapi/content，并且处理了来自不受信任来源的 HTTP 请求，那么您可能受到此漏洞的影响。
将 @hapi/content 升级到 6.0.1 或更高版本可以修复此漏洞。升级后，该库将使用更严格的正则表达式来解析 HTTP 头部，从而防止 ReDoS 攻击。
CVSS 向量