content

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

HTTP Content-* headers parsing

Latest release4.0.6

Declared licenseBSD-3-Clause

Listed maintainershueniverse, marsup, nlf, wyatt

Runtime dependencies1

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataNot recorded

Registry deprecationThis module has moved and is now available at @hapi/content. Please update your dependencies as this version is no longer maintained an may contain bugs and security issues.

Direct dependencies of 4.0.6

boom7.x.x

Fetched 31/10/2026, 10:19:20 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high7.5

CVE-2026-119202Fix available

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

npm / @hapi/content npm / content

2 days ago

content npm

Affected range	Recorded fix
From 3.0.6 through 4.0.6 (inclusive)Semantic versions	Not recorded

Version evidence: OSV · GHSA-8494-f6mr-cjpv

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.0.6"
        },
        {
          "last_affected": "4.0.6"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}