Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-343",
"CWE-345"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33221.json"
}{
"cpe": "cpe:2.3:a:nhost:storage:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "0.12.0"
}
],
"source": [
"CPE_RANGE",
"REFERENCES"
]
}