Is CVE-2026-33221 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33221 being exploited in the wild.

How severe is CVE-2026-33221?

Medium severity, with a CVSS score of 5.3, published 20 March 2026.

Which products and versions are affected?

github.com/nhost/nhost (Go) < 0.0.0-20260318074820-c4bd53f042d7, SEMVER:introduced=0,fixed=0.0.0-20260318074820-c4bd53f042d7; Nhost Storage Service < 0.12.0.

Is there a fix for CVE-2026-33221?

Yes. github.com/nhost/nhost (Go): upgrade to 0.0.0-20260318074820-c4bd53f042d7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33221 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-33221?

Check whether you run github.com/nhost/nhost (Go) or Nhost Storage Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33221: Nhost Storage Service MIME type spoofing in file upload handler

Q: Is there a fix for CVE-2026-33221?

Yes. github.com/nhost/nhost (Go): upgrade to 0.0.0-20260318074820-c4bd53f042d7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33221 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-33221?

Check whether you run github.com/nhost/nhost (Go) or Nhost Storage Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33221 · Severity: medium · CVSS 5.3 · Published 2026-03-20

Nhost Storage, a service used for managing file uploads and storage, is vulnerable to a flaw where it incorrectly trusts the file type claimed by a user's browser or application. This allows an attacker to upload files that appear to be one type (like a harmless image) but actually contain different content, potentially bypassing security filters. This could lead to files being handled incorrectly by web browsers or content delivery networks, which might result in security risks for users who later access those files.

Technologies: github.com/nhost/nhost (Go). Vendors: Go, Nhost.

Quick answers

Is CVE-2026-33221 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33221 being exploited in the wild.
How severe is CVE-2026-33221?: Medium severity, with a CVSS score of 5.3, published 20 March 2026.
Which products and versions are affected?: github.com/nhost/nhost (Go) < 0.0.0-20260318074820-c4bd53f042d7, SEMVER:introduced=0,fixed=0.0.0-20260318074820-c4bd53f042d7; Nhost Storage Service < 0.12.0.
Is there a fix for CVE-2026-33221?: Yes. github.com/nhost/nhost (Go): upgrade to 0.0.0-20260318074820-c4bd53f042d7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33221 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-33221?: Check whether you run github.com/nhost/nhost (Go) or Nhost Storage Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/nhost/nhost (Go): upgrade to 0.0.0-20260318074820-c4bd53f042d7 or later
```
go get github.com/nhost/nhost@v0.0.0-20260318074820-c4bd53f042d7
```

Technical details

The Nhost storage service's file upload handler in `services/storage/controller/upload_files.go` contains a logic flaw in the `getMultipartFile` function. The service prioritizes the client-provided `Content-Type` header; if it is present and not set to `application/octet-stream`, the server skips its internal MIME type detection via `mimetype.DetectReader`. This allows a remote attacker to upload files with arbitrary MIME types in the metadata, bypassing any MIME-type-based restrictions configured on storage buckets. This can lead to incorrect file handling by downstream consumers like browsers or CDNs. The issue is fixed in version 0.0.0-20260318074820-c4bd53f042d7.

Affected products

Nhost Nhost Storage < 0.0.0-20260318074820-c4bd53f042d7

Identifiers

CVE-2026-33221
GHSA-g9f6-9775-hffm
GO-2026-4759

Timeline

2026-03-18: advisory: GitHub Advisory published
2026-03-18: patched: Fix committed to repository
2026-03-20: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.