CVE-2026-44974: hapijs @hapi/content parameter smuggling in header parsing

CVE-2026-44974 · Severity: high · CVSS 4 · Published 2026-07-17

The @hapi/content library is a Node.js package used to parse HTTP Content-* headers, commonly integrated into web applications and APIs. A parameter-smuggling vulnerability allows attackers to bypass file upload restrictions by injecting duplicate filename parameters in Content-Disposition headers. When a security filter expects a safe filename (e.g., "safe.txt") but the server processes a malicious one (e.g., "shell.php"), an attacker can upload and execute arbitrary code, compromising application security and potentially leading to data breaches or service compromise.

Technologies: Hapi Content, @hapi/content (npm). Vendors: Hapi, npm.

Quick answers

Is CVE-2026-44974 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44974 being exploited in the wild.
How severe is CVE-2026-44974?
High severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
Hapi Content < 6.0.2, all versions before 6.0.2; @hapi/content (npm) < 6.0.2, SEMVER:introduced=0,fixed=6.0.2.
Is there a fix for CVE-2026-44974?
Yes. @hapi/content (npm): upgrade to 6.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44974 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44974?
Check whether you run Hapi Content or @hapi/content (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @hapi/content (npm): upgrade to 6.0.2 or later
    npm install @hapi/content@6.0.2

Technical details

The vulnerability exists in the header parsing logic for Content-Disposition and Content-Type headers. Content.disposition() silently retains the last occurrence of duplicate parameters, while Content.type() retains the first occurrence of charset and boundary parameters. This inconsistency creates a parameter-smuggling primitive (CWE-436: Interpretation Conflict). When a duplicate filename parameter is sent (e.g., filename="safe.txt"; filename="shell.php"), a WAF, reverse proxy, or alternate parser in the request chain may resolve it differently than @hapi/content, allowing the malicious filename to bypass validation while being processed by the server. The attack requires no authentication, no special privileges, and can be executed over the network via a crafted HTTP request. The fix, released in version 6.0.2, errors on duplicate parameters instead of silently resolving them.

Affected products

  • hapi @hapi/content all versions before 6.0.2

Identifiers

  • CVE-2026-44974
  • GHSA-36hh-x5p5-jgc8

Timeline

  • 2026-05-27: disclosed: Public disclosure on GitHub Security Advisory GHSA-36hh-x5p5-jgc8
  • 2026-05-06: patched: Fix committed; patch released in version 6.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.