Hapijs vulnerabilities
We track 6 vulnerabilities in Hapijs products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Hapijs vulnerabilities
- 7.5 High severity
content: Inefficient Regular Expression Complexity
@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Dispo
- 7.5 High severity
joi: Inefficient Regular Expression Complexity
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position i
- 7.5 High severity
@hapi/content: Inefficient Regular Expression Complexity
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposi
- 7.5 High severity
joi: Inefficient Regular Expression Complexity
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored,
- 7.7 High severity
content: Interpretation Conflict
@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a pa
- 7.5 High severity
content: Inefficient Regular Expression Complexity
@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-D