CVE-2026-115728 hapijs CVE debrief

Who should care

Node.js developers and administrators using the @hapi/content package should assess exposure and upgrade to version 6.0.1 or later to prevent ReDoS attacks. Affected operators should review and update affected packages, and security teams should monitor for potential ReDoS attacks. Vulnerability management and platform teams should prioritize upgrades and verify affected versions.

Why it matters

CVE-2026-115728 is a high-priority vulnerability in the @hapi/content package that can cause a Node.js process to become unresponsive. Node.js developers and administrators should assess exposure and upgrade to version 6.0.1 or later to prevent ReDoS attacks.

• Denial of Service: an unauthenticated remote attacker can cause a Node.js process to become unresponsive
• Upgrade priority: high, to prevent ReDoS attacks
• Verification priority: verify affected versions and upgrade to 6.0.1 or later

Technical summary

The @hapi/content package is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This has been fixed by tightening all three regular expressions to eliminate backtracking. Affected product context includes Node.js deployments using the @hapi/content package. Defensive impact includes Denial of Service (DoS) attacks. Source-grounded technical framing emphasizes the importance of upgrading to version 6.0.1 or later.

Defensive priority

Upgrade to version 6.0.1 or later to prevent ReDoS attacks

Recommended defensive actions

• Upgrade to version 6.0.1 or later
• Review and update affected packages
• Monitor for potential ReDoS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by three regular expressions used to parse Content-Type and Content-Disposition headers containing patterns susceptible to catastrophic backtracking. This has been fixed by tightening all three regular expressions to eliminate backtracking.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.