The vulnerability is a regular expression denial of service in the Content.disposition() method. When an attacker sends a multipart upload with a long Content‑Disposition header that omits the equals sign, the regex engine performs quadratic backtracking, exhausting CPU cycles and blocking the event loop. This results in a denial of service for the Node.js process handling the request.

The issue affects the hapijs:@hapi/content library, specifically all releases from 6.0.1 up through 6.0.2. Version 6.0.3 and later contain the fix.

The CVSS score of 8.7 marks it as high severity. No EPSS score has been published and it is not listed in CISA's KEV catalog, indicating that widespread exploitation has not been reported yet. The likely attack vector is remote unauthenticated via HTTP multipart uploads, requiring only the ability to send a malicious Content‑Disposition header. An attacker can trigger the denial of service by submitting a sufficiently long parameter, which first causes quadratic backtracking and then hangs the Node.js event loop until the request times out or the server restarts.