Live › vulnerability › CVE-2026-115728
Go to dashboardThe @hapi/content package versions 6.0.1 before 6.0.3 use a regular expression in Content.disposition() that backtracks quadratically on a long parameter without an equals sign. An unauthenticated remote attacker can send a multipart upload with such a header and block the Node.js event loop, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run npm ls @hapi/content in each project and check whether the installed version is 6.0.1 or 6.0.2.
Upgrade @hapi/content to 6.0.3 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
This page as .md · .json · in your agent: get_signal("CVE-2026-115728")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.