The @hapi/content library contains regular expressions that parse Content-Type and Content-Disposition headers. Crafted header values trigger catastrophic backtracking, causing the parsing routine to become computationally expensive and leading to a Service Availability outage. This weakness aligns with CWE‑1333 and is rated with a CVSS score of 8.7.

All versions of the @hapi/content package up to and including 6.0.0 are affected. Versions before 6.0.1 lack the fix, while v6.0.1 and later include the remediation. The product impacted is the hapijs:content library used by web applications to interpret HTTP headers.

The high CVSS score indicates severe impact. No EPSS data is publicly available, making precise exploitation probability uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker crafting malicious HTTP requests with oversized or specially constructed Content-Type or Content-Disposition headers, which the vulnerable library will process, potentially exhausting server resources. The risk is elevated for services that rely directly on @hapi/content without additional header validation.