https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:14:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339087 EUVD-2026-339087 https://cve.radiocsirt.org/vuln/euvd-2026-339087 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44974 <p>@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=&#34;file&#34;; filename=&#34;safe.txt&#34;; filename=&#34;shell.php&#34;. This issue is fixed in version 6.0.2.</p> <p>@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=&#34;file&#34;; filename=&#34;safe.txt&#34;; filename=&#34;shell.php&#34;. This issue is fixed in version 6.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44974 https://cve.radiocsirt.org/vuln/ghsa-36hh-x5p5-jgc8 <p><strong>Affected:</strong> npm: @hapi/content</p> <p>### Impact The two parsers resolved duplicates inconsistently and silently: - `Content.disposition()` retained the last occurrence of each parameter. - `Content.type()` retained the first occurrence of charset and boundary.</p> <p>Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass:</p> <p>`Content-Disposition: form-data; name=&#34;file&#34;; filename=&#34;safe.txt&#34;; filename=&#34;shell.php&#34;`</p> <p>### Patches The issue has been patched in 6.0.2.</p> <p>### Workarounds Pre or post validate headers looking for duplicates.</p> <p>### Resources - [RFC 6266 §4.1 — Content-Disposition syntax](https://www.rfc-editor.org/rfc/rfc6266#section-4.1) - [RFC 7231 §3.1.1.1 — Content-Type syntax](https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1) - [RFC 7230 §3.2.6 — token character set](https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6)</p> <p><strong>Affected:</strong> npm: @hapi/content</p> <p>### Impact The two parsers resolved duplicates inconsistently and silently: - `Content.disposition()` retained the last occurrence of each parameter. - `Content.type()` retained the first occurrence of charset and boundary.</p> <p>Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass:</p> <p>`Content-Disposition: form-data; name=&#34;file&#34;; filename=&#34;safe.txt&#34;; filename=&#34;shell.php&#34;`</p> <p>### Patches The issue has been patched in 6.0.2.</p> <p>### Workarounds Pre or post validate headers looking for duplicates.</p> <p>### Resources - [RFC 6266 §4.1 — Content-Disposition syntax](https://www.rfc-editor.org/rfc/rfc6266#section-4.1) - [RFC 7231 §3.1.1.1 — Content-Type syntax](https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1) - [RFC 7230 §3.2.6 — token character set](https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6)</p> https://cve.radiocsirt.org/vuln/ghsa-36hh-x5p5-jgc8