CVE-2026-115728
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
Risk Assessment
Potential blocking of the server event loop and denial of service for applications using this library.
Recommendation
Update @hapi/content to version 6.0.3 or later, which contains the fix for this issue.
Other vulnerabilities in @hapi/content
See all- CVE-2026-119202High
@hapi/content from 3.0.6 until 6.0.3 uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers, including unauthenticated hapi routes with payload.multipart enabled.
- CVE-2026-44974High
Vulnerability in the @hapi/content library (versions before 6.0.2) for parsing HTTP Content-* headers. Different handling of duplicate parameters can lead to parameter smuggling and bypass of filename allowlists.
- CVE-2026-35213High
The @hapi/content library through version 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.
Original NVD description (English source)
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS