CVE-2026-35213: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35213 is a Regular Expression Denial of Service (ReDoS) vulnerability in the @hapi/content npm package affecting all versions through 6.0.0. Three regular expressions used to parse Content-Type and Content-Disposition HTTP headers contain patterns susceptible to catastrophic backtracking, allowing an unauthenticated remote attacker to render a Node.js process unresponsive with a single crafted HTTP request. The vulnerability was published on April 2, 2026, by maintainer Marsup, with the GitHub Advisory Database entry added on April 4, 2026. It carries a CVSS v4.0 base score of 8.7 (High) and a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, hapijs Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), where three regex patterns within @hapi/content's HTTP header parsing logic exhibit exponential worst-case complexity (catastrophic backtracking) when evaluated against specially crafted input strings (GitHub Advisory). An attacker exploits this by sending a single HTTP request with a maliciously crafted Content-Type or Content-Disposition header value to any endpoint backed by the vulnerable library, triggering excessive CPU consumption in the Node.js event loop. No authentication, privileges, or user interaction are required — the attack is purely network-based with low complexity. The fix, merged in PR #38, tightened all three regular expressions to eliminate backtracking paths (hapijs PR #38).

Successful exploitation results in a complete denial of service for the affected Node.js process: the event loop becomes blocked by CPU-intensive regex backtracking, making the application unresponsive to all legitimate users. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Downstream applications using @hapi/content as a transitive dependency (e.g., via @hapi/hapi, @hapi/subtext, or @hapi/pez) are also affected, broadening the scope to any Node.js HTTP service in the dependency chain, including Kibana deployments (hapijs PR #38, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.25–0.415%, placing it in roughly the 62nd percentile for exploitation probability within 30 days (GitHub Advisory). Despite the low exploitation evidence, the zero-authentication requirement and trivial attack mechanism (a single HTTP request) make it straightforward to weaponize.

1. Reconnaissance: Identify internet-facing Node.js applications using @hapi/hapi or other packages that depend on @hapi/content ≤ 6.0.0 (e.g., Kibana instances, custom hapi.js APIs). Tools like Shodan, Censys, or package dependency scanners can assist.
2. Craft malicious header: Construct an HTTP request with a Content-Type or Content-Disposition header value designed to trigger catastrophic backtracking in the vulnerable regex patterns — typically a long string with repeating characters that match the ambiguous portions of the regex (e.g., a deeply nested or repetitive parameter string).
3. Send the request: Transmit the crafted HTTP request to any accessible endpoint of the target application. No authentication token or session cookie is required.
4. Achieve denial of service: The Node.js event loop becomes blocked processing the malicious regex match, causing the server to stop responding to all subsequent requests, effectively taking the service offline (GitHub Advisory, hapijs Advisory).

• Network: Unusual HTTP requests with abnormally long or malformed Content-Type or Content-Disposition header values (e.g., headers containing deeply repetitive parameter strings or unusual character sequences) targeting any application endpoint.
• Process: Node.js process CPU usage spiking to near 100% sustained for an extended period following receipt of a specific HTTP request; application becoming unresponsive while the process remains running.
• Logs: Web server or application access logs showing a single request immediately preceding a period of unresponsiveness; Node.js process logs may show no output after the triggering request due to event loop blockage.
• Application Monitoring: Sudden drop in request throughput or health check failures coinciding with an anomalous inbound request containing unusual header values.

The only remediation is to upgrade @hapi/content to version 6.0.1 or later, which tightens all three vulnerable regular expressions to eliminate catastrophic backtracking (GitHub Advisory, hapijs PR #38). There are no known configuration-based workarounds. For applications using @hapi/content as a transitive dependency, upgrading the parent package is sufficient — for example, upgrading @hapi/hapi to 21.4.8 or later cascades the fix through @hapi/subtext (≥ 8.1.2) and @hapi/pez (≥ 6.1.1) (hapijs PR #38). IBM has also released an advisory for affected QRadar Suite Software / Cloud Pak for Security products (IBM Advisory).

The Elastic/Kibana team responded promptly, merging a dependency bump (PR #264077) to upgrade @hapi/hapi from 21.4.4 to 21.4.8 to remediate the transitive exposure in Kibana's HTTP server layer (hapijs PR #38). IBM issued a security bulletin noting that QRadar Suite Software includes components affected by this vulnerability (IBM Advisory). Community coverage was limited to vulnerability database aggregators and automated CVE tracking feeds, with no significant independent researcher commentary or broad media coverage identified.