CVE-2026-115728
HighCVSS 7.5Summary
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
Risk Assessment
Potential blocking of the server event loop and denial of service for applications using this library.
Recommendation
Update @hapi/content to version 6.0.3 or later, which contains the fix for this issue.
Other vulnerabilities in @hapi/content
See all- CVE-2026-44974High
Vulnerability in the @hapi/content library (versions before 6.0.2) for parsing HTTP Content-* headers. Different handling of duplicate parameters can lead to parameter smuggling and bypass of filename allowlists.
- CVE-2026-35213High
The @hapi/content library through version 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.
Original NVD description (English source)
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS