@hapi/content CVE-2026-44974
HIGH
GHSA-36hh-x5p5-jgc8
Lifecycle Timeline
2Blast Radius
ecosystem impact- 497 npm packages depend on @hapi/content (4 direct, 493 indirect)
Ecosystem-wide dependent count for version 6.0.2.
DescriptionNVD
Impact
The two parsers resolved duplicates inconsistently and silently:
Content.disposition()retained the last occurrence of each parameter.Content.type()retained the first occurrence of charset and boundary.
Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass:
Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php"
Patches
The issue has been patched in 6.0.2.
Workarounds
Pre or post validate headers looking for duplicates.
Resources
AnalysisAI
Upload filename allowlist bypass in the @hapi/content npm header parser (versions < 6.0.2) lets remote attackers smuggle malicious parameters past upstream validation. The library's Content.disposition() retained the last occurrence of a duplicated parameter while Content.type() retained the first occurrence of charset/boundary, so when a WAF, reverse proxy, or security filter resolves the same duplicate the opposite way, the two layers disagree on values such as the upload filename. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: scan all Node.js applications for @hapi/content dependency versions < 6.0.2 using npm audit or equivalent SBOM tools. Within 7 days: upgrade all affected instances to @hapi/content version 6.0.2 or later and redeploy applications. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today