Vulnerability · Published Oct 23, 2026 · Assigned by VulnCheck

CVE-2026-115728@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

High 7.5

In plain English

A high-severity regular-expression denial of service in @hapi/content from hapijs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@hapi/content	6.0.1	GHSA-jg4p-7fhp-p32p

Affected products (as reported)

Vendor	Product	Versions
hapijs	@hapi/content	6.0.1 – before 6.0.3

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/hapijs/content/pull/42 issue-tracking, patch
https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd patch
https://github.com/hapijs/content/tree/v6.0.3 release-notes
https://github.com/hapijs/content/blob/v6.0.2/lib/index.js#L96 technical-description
GitHub Security Advisory (GHSA-jg4p-7fhp-p32p) related, vendor-advisory
VulnCheck Advisory: @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing third-party-advisory