What’s Vulnerable › Vulnerabilities

CVE-2026-44974: Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters

• Severity: high (CVSS 7.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-17 · updated 2026-10-24
• Weakness: CWE-436

Description

@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.

Affected products

• hapijs content: before 6.0.2

References

• https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f
• https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8

Get alerted when CVE-2026-44974 or the next vulnerability affects your stack