Regular Expression Denial of Service in @hapi/content by Hapi

CVE-2026-115728

What is CVE-2026-115728?

The @hapi/content library, specifically versions 6.0.1 and 6.0.2, is susceptible to a regular expression denial of service attack through its Content.disposition() function. This vulnerability arises when unauthenticated remote attackers send multipart uploads that include a lengthy Content-Disposition parameter which lacks an equals sign. This scenario causes a quadratic backtracking issue within the regular expression parsing, leading to significant performance degradation and blocking of the event loop, rendering the application unresponsive.

References