Executive brief
The @hapi/content library is a Node.js package used to parse HTTP Content-* headers, commonly integrated into web applications and APIs. A parameter-smuggling vulnerability allows attackers to bypass file upload restrictions by injecting duplicate filename parameters in Content-Disposition headers. When a security filter expects a safe filename (e.g., "safe.txt") but the server processes a malicious one (e.g., "shell.php"), an attacker can upload and execute arbitrary code, compromising application security and potentially leading to data breaches or service compromise.
Technical details
The vulnerability exists in the header parsing logic for Content-Disposition and Content-Type headers. Content.disposition() silently retains the last occurrence of duplicate parameters, while Content.type() retains the first occurrence of charset and boundary parameters. This inconsistency creates a parameter-smuggling primitive (CWE-436: Interpretation Conflict). When a duplicate filename parameter is sent (e.g., filename="safe.txt"; filename="shell.php"), a WAF, reverse proxy, or alternate parser in the request chain may resolve it differently than @hapi/content, allowing the malicious filename to bypass validation while being processed by the server. The attack requires no authentication, no special privileges, and can be executed over the network via a crafted HTTP request. The fix, released in version 6.0.2, errors on duplicate parameters instead of silently resolving them.
Affected products
- hapi @hapi/content all versions before 6.0.2
Timeline
- 2026-05-27: disclosed: Public disclosure on GitHub Security Advisory GHSA-36hh-x5p5-jgc8
- 2026-05-06: patched: Fix committed; patch released in version 6.0.2