CVE-2026-35213

OVERVIEW CVE-2026-35213 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting @hapi/content, a Node.js library used for parsing HTTP Content-* headers. The flaw exists in all versions through 6.0.0 and stems from three regular expressions designed to parse Content-Type and Content-Disposition headers that are susceptible to catastrophic backtracking when processing specially crafted input. The vulnerability was resolved in version 6.0.1. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH), indicating significant risk with a network-based attack vector, low attack complexity, and no authentication requirements. The primary impact is availability disruption, as successful exploitation allows an unauthenticated attacker to cause denial of service conditions. The attack requires no user interaction or special privileges, making it accessible to remote adversaries. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild, as the vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) database and remains inactive on threat intelligence hot lists. However, the relatively low EPSS score of 0.0036 suggests minimal real-world exploitation probability at present. Organizations should prioritize upgrading to version 6.0.1 to mitigate this availability risk, particularly for internet-facing systems relying on @hapi/content.