# CVE-2026-44974: hapijs @hapi/content parameter smuggling in header parsing

Source: https://junglewise.ai/threats/cve-2026-44974-hapijs-hapi-content-parameter-smuggling-in-header-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44974 · Severity: high · CVSS 4 · Published 2026-07-17

The @hapi/content library is a Node.js package used to parse HTTP Content-* headers, commonly integrated into web applications and APIs. A parameter-smuggling vulnerability allows attackers to bypass file upload restrictions by injecting duplicate filename parameters in Content-Disposition headers. When a security filter expects a safe filename (e.g., "safe.txt") but the server processes a malicious one (e.g., "shell.php"), an attacker can upload and execute arbitrary code, compromising application security and potentially leading to data breaches or service compromise.

Technologies: [Hapi Content](https://junglewise.ai/threats/technologies/content), [@hapi/content (npm)](https://junglewise.ai/threats/technologies/hapi-content). Vendors: [Hapi](https://junglewise.ai/threats/vendors/hapi), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44974 being exploited in the wild.

**How severe is CVE-2026-44974?** High severity, with a CVSS score of 4, published 17 July 2026.

**Which products and versions are affected?** Hapi Content < 6.0.2, all versions before 6.0.2; @hapi/content (npm) < 6.0.2, SEMVER:introduced=0,fixed=6.0.2.

**Is there a fix for CVE-2026-44974?** Yes. @hapi/content (npm): upgrade to 6.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44974 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44974?** Check whether you run Hapi Content or @hapi/content (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hapi/content (npm): upgrade to 6.0.2 or later

  ```sh
  npm install @hapi/content@6.0.2
  ```


## Technical details

The vulnerability exists in the header parsing logic for Content-Disposition and Content-Type headers. Content.disposition() silently retains the last occurrence of duplicate parameters, while Content.type() retains the first occurrence of charset and boundary parameters. This inconsistency creates a parameter-smuggling primitive (CWE-436: Interpretation Conflict). When a duplicate filename parameter is sent (e.g., filename="safe.txt"; filename="shell.php"), a WAF, reverse proxy, or alternate parser in the request chain may resolve it differently than @hapi/content, allowing the malicious filename to bypass validation while being processed by the server. The attack requires no authentication, no special privileges, and can be executed over the network via a crafted HTTP request. The fix, released in version 6.0.2, errors on duplicate parameters instead of silently resolving them.

## Affected products

- hapi @hapi/content all versions before 6.0.2

## Identifiers

- CVE-2026-44974
- GHSA-36hh-x5p5-jgc8

## Timeline

- 2026-05-27: disclosed: Public disclosure on GitHub Security Advisory GHSA-36hh-x5p5-jgc8
- 2026-05-06: patched: Fix committed; patch released in version 6.0.2

## References

- [https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8](https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8)
- [https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f](https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f)
- [https://github.com/hapijs/content](https://github.com/hapijs/content)

## Related threats

- [@hapi/content ReDoS in Content-Disposition parsing](https://junglewise.ai/threats/cve-2026-119202-hapi-content-provides-http-content-header-parsing-from-3-0-6)
- [hapijs @hapi/content ReDoS in HTTP header parsing](https://junglewise.ai/threats/cve-2026-35213-hapijs-hapi-content-redos-in-http-header-parsing)
- [hapi @hapi/content denial of service in HTTP header parser](https://junglewise.ai/threats/hapi-hapi-content-denial-of-service-in-http-header-parser-d6ae9a5f)