Parameter smuggling in the @hapi/content npm package (CVE-2026-44974)

CVE-2026-44974 is a parameter smuggling vulnerability in the @hapi/content npm package, where the `Content.disposition()` and `Content.type()` parsers resolve duplicate header parameters inconsistently: the former retains the last occurrence, the latter retains the first. This inconsistency can be exploited when another component in the request-processing chain (such as a WAF, reverse proxy, or alternate parser) resolves duplicates differently, enabling an attacker to bypass upload filename allowlists and similar security filters by supplying duplicate parameters with differing values. Affected versions: - < 6.0.2 We recommend updating to: 6.0.2. CVSS 7.7 · our assessment: this_week Vendor advisory: https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8 Details: https://vuln.today/cve/CVE-2026-44974