CVE-2026-115728: Inefficient Regular Expression Complexity in hapijs @hapi/content
Description
@hapi/content versions 6.0.1 through before 6.0.3 contain a regular expression denial of service (ReDoS) vulnerability in the Content.disposition() function. This issue arises from an incomplete fix for a previous vulnerability (CVE-2026-35213). An unauthenticated remote attacker can exploit this by sending multipart uploads with a long Content-Disposition parameter that lacks an equals sign, causing quadratic backtracking that blocks the event loop.
CVSS v4.0
Score 8.7high
Affected software
hapijs
@hapi/content
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-115728 affects the @hapi/content package versions >=6.0.1 and <6.0.3. It is a regular expression denial of service (ReDoS) flaw in the Content.disposition() method. The root cause is an incomplete remediation of a prior vulnerability (CVE-2026-35213), allowing an attacker to craft multipart upload requests with a long Content-Disposition header missing an equals sign. This triggers quadratic backtracking in the regex engine, leading to event loop blocking and denial of service. The vulnerability is exploitable remotely without authentication.
Potential Impact
Successful exploitation results in denial of service by blocking the event loop, potentially causing application unavailability. The attack requires no authentication and can be triggered remotely by sending specially crafted multipart uploads. There is no indication of data compromise or privilege escalation from this vulnerability.
Mitigation Recommendations
A fix is available in @hapi/content version 6.0.3 and later. Users should upgrade to version 6.0.3 or above to remediate this vulnerability. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-23T11:40:38.070Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb5ab74d27ba8daa286696
Added to database: 10/23/2026, 13:01:43 UTC
Last enriched: 10/23/2026, 13:15:36 UTC
Last updated: 10/23/2026, 13:31:46 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.