CVE-2026-115728: @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

Q: Which deployments are exposed to this issue?

Deployments using @hapi/content version 6.0.1 or 6.0.2 are affected where attacker-controlled multipart uploads reach Content.disposition(). Version 6.0.3 is outside the affected range.

Q: What does an attacker need to exploit it?

No authentication or user interaction is required. An attacker needs to send a multipart upload containing a long Content-Disposition parameter without an equals sign.

Q: What is the practical impact of a successful attack?

The crafted parameter triggers quadratic regular-expression backtracking, blocking the Node.js event loop. This can cause a denial of service.

Published Oct 23, 2026

Updated

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

Affected Software

1 affected component

npm/@hapi/content>=6.0.1<6.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @hapi/content to a version that resolves this vulnerability.
Fixed in 6.0.3

Event History

Oct 23, 2026

CVE Published

via MITRE·12:55 PM

Data Sourced

via MITRE·12:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using @hapi/content version 6.0.1 or 6.0.2 are affected where attacker-controlled multipart uploads reach Content.disposition(). Version 6.0.3 is outside the affected range.

What does an attacker need to exploit it?

No authentication or user interaction is required. An attacker needs to send a multipart upload containing a long Content-Disposition parameter without an equals sign.

What is the practical impact of a successful attack?

The crafted parameter triggers quadratic regular-expression backtracking, blocking the Node.js event loop. This can cause a denial of service.

CVE-2026-115728: @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of a successful attack?