{"id":"CVE-2026-44974","sourceIdentifier":"security-advisories@github.com","published":"2026-07-17T20:17:16.727","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"; filename=\"shell.php\". This issue is fixed in version 6.0.2."},{"lang":"es","value":"@hapi/content proporcionaba el análisis de los encabezados HTTP Content-*. Antes de la versión 6.0.2, Content.disposition() retenía la última ocurrencia de cada parámetro duplicado, mientras que Content.type() retenía la primera ocurrencia de los parámetros duplicados ’charset’ y ’boundary’, creando una primitiva de contrabando de parámetros cuando otro componente en la cadena de procesamiento de solicitudes resolvía los duplicados de la manera opuesta. Esto puede permitir una omisión de la lista blanca de nombres de archivo de carga en encabezados como Content-Disposition: form-data; name=’file’; filename=’safe.txt’; filename=’shell.PHP’. Este problema está solucionado en la versión 6.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hapijs","product":"content","versions":[{"version":"< 6.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-21T02:14:35.542197Z","id":"CVE-2026-44974","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-436"}]}],"references":[{"url":"https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8","source":"security-advisories@github.com"}]}