CVE-2026-115728— @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing
Quick assessment
Affected
hapijs @hapi/content
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
库在 6.0.1 版本至 6.0.3 版本（不含 6.0.3）中存在正则表达式拒绝服务（ReDoS）漏洞。该漏洞源于对 CVE-2026-35213 的修复不完整，具体出现在 函数中。未经身份验证的远程攻击者可以发送包含超长 参数（且该参数缺少等号）的多部分上传请求，从而触发二次回溯，导致事件循环阻塞。
Possible ATT&CK Techniques 2 AI
T1499.003 · Application Exhaustion Flood T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| hapijs | @hapi/content | 6.0.1< 6.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115728
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing
Source: CVE Program / CVE List V5
Vulnerability Description
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| hapijs | @hapi/content | 6.0.1 ~ 6.0.3 | - |
|
II. Public POCs for CVE-2026-115728
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115728
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-115728 (1)
Vendor Advisories for CVE-2026-115728 (1)
Other References for CVE-2026-115728 (1)
IV. Related Vulnerabilities
Same vendor: hapijs
-
CVE-2026-92599
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate -
CVE-2026-90771
joi before 17.13.8 and 18.2.9 Prototype Pollution via messag -
CVE-2026-84368
joi: Prototype pollution via a `__proto__` language key in c -
CVE-2026-84367
joi: object().rename() with a template target can set the va -
CVE-2026-48049
@hapi/inert: Static-file confinement bypass via sibling-pref
Same weakness: CWE-1333
-
CVE-2026-115887
graphql-scalars PhoneNumber scalar is vulnerable to regular -
CVE-2026-115508
Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields -
CVE-2026-115349
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Brac -
CVE-2026-112901
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image. -
CVE-2026-112300
DiffSK configobj __init__.py _sectionmarker redos
V. Comments for CVE-2026-115728
No comments yet