T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

bench/cve-zero/results/hunt-GHSA-36hh-x5p5-jgc8.json

@@ -1 +1 @@
-{"id": "GHSA-36hh-x5p5-jgc8", "cve": "CVE-2026-44974", "repo": "hapijs/content", "cwes": ["CWE-436"], "vuln_files": ["lib/index.js"], "duration_sec": 143.2, "error": null, "strict": false, "lenient": false, "findings_scored": [{"fileMatch": true, "lineProx": false, "cweMatch": false, "hit": false, "title": "ReDoS (quadratic backtracking) in Content-Disposition parameter parsing", "file": "lib/index.js", "line": 88, "cwe": "CWE-1333"}], "n_findings": 1, "findings": [{"title": "ReDoS (quadratic backtracking) in Content-Disposition parameter parsing", "file": "lib/index.js", "line": 88, "cwe": "CWE-1333", "vuln_class": "dos", "severity": "high", "description": "exports.disposition() validates the header against contentDispositionRegex (line 96), extracts the parameter substring (match[1]), and then runs the global regex internals.contentDispositionParamRegex (line 88) over it via String.replace at line 107. That regex starts with the greedy group ([^\\=\\*\\s]+) which must then be followed by \\s*\\=. When attacker input contains a long run of non-'=', non-'*', non-whitespace characters that never contains an '=' (e.g. 'form-data; aaaaa...'), the greedy group matches the whole run, fails to find '=', and because the regex is global, String.replace re-attempts the match starting at every subsequent position. Each attempt does O(n) work, yielding O(n^2) total time with no upstream length limit in this module. Measured: 20k chars = 0.3s, 40k = 1.3s, 80k = 5.3s, 100k = 8.2s, 200k = 32s. This synchronously blocks the single-threaded Node.js event loop. The header value is fully attacker-controlled and reaches the sink without any length/complexity sanitizer (the only pre-checks are __proto__ guards and the form-data prefix match, neither of which limits input size).", "poc": "Send a multipart request whose part Content-Disposition header (or call Content.disposition() directly) is: 'form-data; ' followed by ~100000 'a' characters with no '=' sign. Example: Content.disposition('form-data; ' + 'a'.repeat(100000)) blocks the event loop for ~8 seconds; scaling the length increases the stall quadratically, enabling a single small-ish request to cause sustained denial of service.", "confidence": 0.9}], "transcript": ""}
+{"id": "GHSA-36hh-x5p5-jgc8", "cve": "CVE-2026-44974", "repo": "hapijs/content", "cwes": ["CWE-436"], "vuln_files": ["lib/index.js"], "duration_sec": 112.6, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": false, "hit": true, "title": "Quadratic ReDoS in Content-Disposition parameter parsing", "file": "lib/index.js", "line": 107, "cwe": "CWE-1333"}], "n_findings": 1, "findings": [{"title": "Quadratic ReDoS in Content-Disposition parameter parsing", "file": "lib/index.js", "line": 107, "cwe": "CWE-1333", "vuln_class": "dos", "severity": "high", "description": "exports.disposition(header) parses the attacker-controlled Content-Disposition header. After the outer contentDispositionRegex captures the full parameter tail into match[1] (parameters), the code calls parameters.replace(internals.contentDispositionParamRegex, ...). The param regex begins with the group ([^\\=\\*\\s]+), which greedily matches any run of characters that are not '=', '*' or whitespace and must then be followed by '\\='. When the parameter string contains a long run of such characters with no '=', String.prototype.replace re-attempts the match at every start offset, and at each offset the leading [^=*\\s]+ consumes to the end and backtracks looking for '=' that never appears. This yields O(n^2) time in the length of the header value. No length validation or sanitizer sits between the source (raw header) and this sink. The regex is also module-global (/g) but the dominant cost is the per-offset backtracking. Measured: ~665ms for 40KB, ~2.6s for 80KB, ~10.5s for 160KB (ratio ~4x per 2x input => quadratic). This is reachable unauthenticated on any hapi endpoint accepting multipart uploads.", "poc": "Send an HTTP multipart request whose part contains a header:  Content-Disposition: form-data; name=\"x\"; aaaaaaaa...aaaa  (append ~150,000+ 'a' characters, i.e. a long run containing no '=' sign). Parsing this single header via content.disposition() blocks the Node.js event loop for ~10 seconds; a few such concurrent requests hang the server. Minimal reproducer: require('@hapi/content').disposition('form-data; name=\"x\"; ' + 'a'.repeat(160000));", "confidence": 0.88}], "transcript": ""}