All vulnerabilities
CVE-2026-115728CVE-2026-35213GHSA-jg4p-7fhp-p32p

@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

hapijs @hapi/contentnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in6.0.3Also 6.0.1CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 6.0.3@hapi/contentCVE List
  • 6.0.1@hapi/content, npmOSVnpm install @hapi/content@6.0.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

Text from CVE List

Affected versions 2

  • @hapi/contentaffected: 6.0.1 before 6.0.3CVE List
  • @hapi/content, npmfrom first release, fixed in 6.0.1OSV

References 6