GHSA-36hh-x5p5-jgc8

Source

https://github.com/advisories/GHSA-36hh-x5p5-jgc8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-36hh-x5p5-jgc8/GHSA-36hh-x5p5-jgc8.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-36hh-x5p5-jgc8

Aliases

CVE-2026-44974

Downstream

CGA (24)

MINI (14)

Published

2026-05-27T00:37:20Z

Modified

2026-08-24T00:36:43Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N CVSS Calculator

Summary

@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters

Details

Impact

The two parsers resolved duplicates inconsistently and silently:

Content.disposition() retained the last occurrence of each parameter.
Content.type() retained the first occurrence of charset and boundary.

Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass:

Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php"

Patches

The issue has been patched in 6.0.2.

Workarounds

Pre or post validate headers looking for duplicates.

Resources

Database specific

{
    "cwe_ids":  [
        "CWE-436"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-27T00:37:20Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / @hapi/content

Package

Name: @hapi/content; View open source insights on deps.dev
Purl: pkg:npm/%40hapi/content

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-36hh-x5p5-jgc8/GHSA-36hh-x5p5-jgc8.json"