{"schema":"threatline.record/2","record":{"id":"CVE-2026-115728","aliases":["CVE-2026-35213","GHSA-jg4p-7fhp-p32p"],"summary":"@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing","details":"@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.","categories":["Libraries & packages"],"product":"@hapi/content","vendor":"hapijs","ecosystem":"npm","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115728","source_modified_at":"2026-10-23T12:55:08.425Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"@hapi/content","vendor":"hapijs","versions":[{"lessThan":"6.0.3","status":"affected","version":"6.0.1","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jg4p-7fhp-p32p","source_modified_at":"2026-09-10T03:51:02.379000278Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"npm","name":"@hapi/content","purl":"pkg:npm/%40hapi/content"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.0.1"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115728","source_modified_at":"2026-10-23T12:55:08.425Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@hapi/content","ecosystem":null},"version":"6.0.3","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jg4p-7fhp-p32p","source_modified_at":"2026-09-10T03:51:02.379000278Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"npm","name":"@hapi/content","purl":"pkg:npm/%40hapi/content"},"version":"6.0.1"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00848,"percentile":0.57749,"score_date":"2026-10-24"},"published_at":"2026-10-23T12:55:08.425Z","modified_at":"2026-10-23T12:55:08.425Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115728","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T12:55:08.425Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-jg4p-7fhp-p32p","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-10T03:51:02.379000278Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115728","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/hapijs/content/pull/42","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd","tags":["patch"]},{"source":"CVE List","url":"https://github.com/hapijs/content/tree/v6.0.3","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/hapijs/content/blob/v6.0.2/lib/index.js#L96","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p","tags":["related","vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/hapi-content-6.0.1-before-6.0.3-redos-via-content-disposition-parameter-parsing","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T12:55:08.425Z","content_hash":"890b0ef9a8cf9718917d72488c24ae9e7332980bcde67a88287931dea7d599bf"}}