CVE-2026-44974

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44974", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T16:23:33.263Z", "datePublished": "2026-07-17T20:11:44.250Z", "dateUpdated": "2026-07-21T02:16:04.352Z"}, "containers": {"cna": {"title": "Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters", "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "lang": "en", "description": "CWE-436: Interpretation Conflict", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8"}, {"name": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f", "tags": ["x_refsource_MISC"], "url": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f"}], "affected": [{"vendor": "hapijs", "product": "content", "versions": [{"version": "< 6.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:11:44.250Z"}, "descriptions": [{"lang": "en", "value": "@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"; filename=\"shell.php\". This issue is fixed in version 6.0.2."}], "source": {"advisory": "GHSA-36hh-x5p5-jgc8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T02:14:35.542197Z", "id": "CVE-2026-44974", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T02:16:04.352Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44974", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T02:14:35.542197Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T02:15:58.679Z"}}], "cna": {"title": "Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters", "source": {"advisory": "GHSA-36hh-x5p5-jgc8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "hapijs", "product": "content", "versions": [{"status": "affected", "version": "< 6.0.2"}]}], "references": [{"url": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8", "name": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f", "name": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"; filename=\"shell.php\". This issue is fixed in version 6.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-436", "description": "CWE-436: Interpretation Conflict"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:11:44.250Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44974", "state": "PUBLISHED", "dateUpdated": "2026-07-21T02:16:04.352Z", "dateReserved": "2026-05-08T16:23:33.263Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-17T20:11:44.250Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "content", "vendor": "hapijs", "versions": [{"status": "affected", "version": "< 6.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"; filename=\"shell.php\". This issue is fixed in version 6.0.2."}, {"lang": "es", "value": "@hapi/content proporcionaba el an\u00e1lisis de los encabezados HTTP Content-*. Antes de la versi\u00f3n 6.0.2, Content.disposition() reten\u00eda la \u00faltima ocurrencia de cada par\u00e1metro duplicado, mientras que Content.type() reten\u00eda la primera ocurrencia de los par\u00e1metros duplicados \u2019charset\u2019 y \u2019boundary\u2019, creando una primitiva de contrabando de par\u00e1metros cuando otro componente en la cadena de procesamiento de solicitudes resolv\u00eda los duplicados de la manera opuesta. Esto puede permitir una omisi\u00f3n de la lista blanca de nombres de archivo de carga en encabezados como Content-Disposition: form-data; name=\u2019file\u2019; filename=\u2019safe.txt\u2019; filename=\u2019shell.PHP\u2019. Este problema est\u00e1 solucionado en la versi\u00f3n 6.0.2."}], "id": "CVE-2026-44974", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44974", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T02:14:35.542197Z", "version": "2.0.3"}}]}, "published": "2026-07-17T20:17:16.727", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f"}, {"source": "security-advisories@github.com", "url": "https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "content", "source": "cna", "vendor": "hapijs"}, "product": "content", "vendor": "hapijs"}], "created": "2026-07-17T21:45:03.895133+00:00", "updated": "2026-07-30T23:45:05.248152+00:00", "vendors": ["hapijs", "hapijs$PRODUCT$content"]}