CVE-2026-115728
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an in
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 23, 2026 · Last modified: Oct 23, 2026 · CWE-1333
Not enough EPSS history yet.
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
- github.comhttps://github.com/hapijs/content/blob/v6.0.2/lib/index.js#L96
- github.comhttps://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd
- github.comhttps://github.com/hapijs/content/pull/42
- github.comhttps://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p
- github.comhttps://github.com/hapijs/content/tree/v6.0.3
- www.vulncheck.comhttps://www.vulncheck.com/advisories/hapi-content-6.0.1-before-6.0.3-redos-via-content-disposition-parameter-parsing
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1155086.5 MED22.1%
——7Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.7hCVE-2026-1153497.5 HIG26.7%
——8Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.1dCVE-2026-112901—20.6%
——6Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0.3dCVE-2026-1123005.3 MED33.7%
——10A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.3dCVE-2026-1123667.5 HIG26.1%
——8Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.4dCVE-2026-111997—15.8%
——5ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.4d