CVE-2026-115728 in Content
Summary
by MITRE • 10/23/2026
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/24/2026
The hapi/content module, specifically versions ranging from 6.0.1 to just before 6.0.3, contains a critical regular expression denial of service vulnerability within its Content.disposition() function. This flaw represents an incomplete remediation for CVE-2026-35213, indicating that previous security patches failed to fully address the underlying parsing logic issues. The vulnerability stems from how the library processes multipart form data uploads, particularly when handling the Content-Disposition header field. Attackers can exploit this by crafting malicious HTTP requests containing a specifically designed long string in the Content-Disposition parameter that lacks an equals sign. This specific malformed input triggers catastrophic backtracking within the regular expression engine used to parse the header value.
From a technical perspective, the core issue lies in the regex pattern's inability to efficiently handle ambiguous or incomplete token structures. When the parser encounters a long sequence of characters without the expected delimiter structure, it enters a state of exponential time complexity due to nested quantifiers and backtracking mechanisms inherent in many regular expression implementations. This results in quadratic computational overhead relative to the length of the input string. As the event loop is single-threaded in Node.js environments where hapi operates, this excessive CPU consumption effectively blocks all other operations within that process. Consequently, legitimate requests are delayed or dropped entirely, leading to a complete service outage for any application relying on this library for content negotiation and multipart parsing.
The operational impact of this vulnerability is severe, as it allows unauthenticated remote attackers to achieve denial of service without requiring valid credentials. An attacker can simply send multiple concurrent requests with the crafted Content-Disposition headers to exhaust server resources rapidly. This aligns with CWE-400, which classifies issues related to unconstrained resource consumption, and specifically maps to ATT&CK technique T1496, Resource Hijacking, where attackers use computational resources for denial of service rather than data exfiltration or system compromise. The lack of an equals sign in the parameter is a key indicator of malicious intent designed to bypass standard validation checks that might otherwise reject malformed headers earlier in the pipeline.
To mitigate this risk, organizations using hapi/content must immediately upgrade to version 6.0.3 or later, where the regular expression logic has been hardened against backtracking attacks. Input sanitization strategies should also be implemented at the application level to validate Content-Disposition header formats before they reach the parsing library. This includes enforcing strict length limits and ensuring that multipart headers adhere strictly to RFC standards regarding parameter syntax. Additionally, deploying web application firewalls with rules capable of detecting abnormal regex execution times or malformed HTTP headers can provide an additional layer of defense against exploitation attempts targeting this specific vulnerability in production environments.