{"id":"GHSA-36hh-x5p5-jgc8","revision":"5683f857fc6f4bd1a58c3cbf23a93cdc","records":[{"revision":"5683f857fc6f4bd1a58c3cbf23a93cdc","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-36hh-x5p5-jgc8","aliases":["CVE-2026-44974"],"title":"@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters","description":"### Impact\nThe two parsers resolved duplicates inconsistently and silently:\n- `Content.disposition()` retained the last occurrence of each parameter.\n- `Content.type()` retained the first occurrence of charset and boundary.\n\nEither behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass:\n\n`Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"; filename=\"shell.php\"`\n\n### Patches\nThe issue has been patched in 6.0.2.\n\n### Workarounds\nPre or post validate headers looking for duplicates.\n\n### Resources\n- [RFC 6266 §4.1 — Content-Disposition syntax](https://www.rfc-editor.org/rfc/rfc6266#section-4.1)\n- [RFC 7231 §3.1.1.1 — Content-Type syntax](https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1)\n- [RFC 7230 §3.2.6 — token character set](https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6)","state":0,"publishedAt":"2026-05-27T00:37:20+00:00","modifiedAt":"2026-09-10T03:51:04.3353685+00:00","affected":[{"ecosystem":"npm","name":"@hapi/content","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8","https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f","https://github.com/hapijs/content"],"sourceUrl":"https://github.com/advisories/GHSA-36hh-x5p5-jgc8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-36hh-x5p5-jgc8","identifiers":["GHSA-36hh-x5p5-jgc8","CVE-2026-44974"]},"retained":false,"historicalAffected":[]}],"coverage":[]}