Most recent entries from all

EUVD-2026-339087

2026-10-05T19:16:14.865395+00:00

EUVD-2026-339087

fkie_cve-2026-44974

2026-10-05T19:16:14.865440+00:00

@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.

GHSA-36hh-x5p5-jgc8 — @hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters

2026-10-05T19:16:14.865479+00:00

Affected: npm: @hapi/content

### Impact The two parsers resolved duplicates inconsistently and silently: - `Content.disposition()` retained the last occurrence of each parameter. - `Content.type()` retained the first occurrence of charset and boundary.

Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass:

`Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php"`

### Patches The issue has been patched in 6.0.2.

### Workarounds Pre or post validate headers looking for duplicates.

### Resources - [RFC 6266 §4.1 — Content-Disposition syntax](https://www.rfc-editor.org/rfc/rfc6266#section-4.1) - [RFC 7231 §3.1.1.1 — Content-Type syntax](https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1) - [RFC 7230 §3.2.6 — token character set](https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6)