CVE-2026-44974
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in the @hapi/content library (versions before 6.0.2) for parsing HTTP Content-* headers. Different handling of duplicate parameters can lead to parameter smuggling and bypass of filename allowlists.
Risk Assessment
An attacker could bypass filename allowlists in headers like Content-Disposition, potentially leading to uploading a malicious file.
Recommendation
Update @hapi/content to version 6.0.2 or later. Check if other components in the processing chain are vulnerable to similar attacks.
Other vulnerabilities in @hapi/content
See all- CVE-2026-115728High
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
- CVE-2026-35213High
The @hapi/content library through version 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.
Original NVD description (English source)
@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS