Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-343",
"CWE-345"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33221.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:nhost:storage:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.12.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "c4bd53f042d7f568e567e18e2665af81660fce85"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "storage@0.12.0",
"range": [
{
"fixed": "b6ce6d5e22c1f28fd7de613fcf8020e7c855f3ac"
}
],
"source": "REFERENCES_TAG"
}
]
}