CVE-2026-44974 Overview
CVE-2026-44974 is a parameter-smuggling vulnerability in @hapi/content, a Node.js module that parses HTTP Content-* headers for the hapi.js framework. Versions prior to 6.0.2 handle duplicate parameters inconsistently: Content.disposition() retains the last occurrence of duplicate parameters, while Content.type() retains the first occurrence of duplicate charset and boundary parameters. When another component in the request-processing chain resolves duplicates the opposite way, attackers can smuggle values past validation. This enables upload filename allowlist bypass through crafted Content-Disposition headers containing repeated filename parameters. The issue is classified as [CWE-436] Interpretation Conflict and is fixed in version 6.0.2.
Critical Impact
Attackers can bypass filename allowlists in upload endpoints by supplying duplicate filename parameters, potentially delivering executable content such as shell.php under the guise of a validated filename like safe.txt.
Affected Products
- @hapi/content versions prior to 6.0.2
- hapi.js applications that consume @hapi/content for multipart or content header parsing
- Upstream frameworks and middleware embedding vulnerable versions of @hapi/content
Discovery Timeline
- 2026-07-17 - CVE-2026-44974 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-44974
Vulnerability Analysis
The defect lives in how @hapi/content parses parameter lists in HTTP Content-* headers. Content.disposition() iterates parameters and overwrites prior entries, so the final duplicate wins. Content.type() short-circuits on the first charset or boundary match, so the first duplicate wins. This asymmetry, together with any upstream or downstream component that resolves duplicates differently, creates an interpretation conflict.
An attacker who controls a Content-Disposition header can pass an allowlisted filename value to a validator and a malicious filename value to the file-writing sink. The result is an upload allowlist bypass that lets attackers introduce arbitrary file extensions, including server-executable types.
Root Cause
The root cause is inconsistent duplicate-parameter handling within a single library. Content.disposition() preserves last-occurrence semantics while Content.type() preserves first-occurrence semantics. Neither function rejects duplicates. The fix in commit 3850079550c191d25e3643dc82a6d61144db8c2f tightens the contentTypeRegex and treats duplicate parameters as an error condition rather than silently collapsing them.
Attack Vector
Exploitation requires only the ability to send an HTTP request to a vulnerable endpoint. No authentication or user interaction is needed. A representative malicious header is:
Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php"
A validator checking the first filename sees safe.txt and permits the upload, while the sink using @hapi/content resolves the last filename to shell.php and writes the file under that name.
parameter = token "=" ( token / quoted-string )
*/
-// 1: type/subtype 2: params
-internals.contentTypeRegex = /^([^\/\s]+\/[^\s;]+)([ \t;][^\r\n]*)?$/;
+// 1: type/subtype 2: params
+internals.contentTypeRegex = /^([A-Za-z0-9!#$%&'*+.^_`|~-]+\/[A-Za-z0-9!#$%&'*+.^_`|~-]+)([ \t;][^\r\n]*)?$/;
// 1: "b" 2: b
internals.charsetParamRegex = /;\s*charset=(?:"([^"]+)"|([^;"\s]+))/i;
Source: GitHub Commit 3850079
Detection Methods for CVE-2026-44974
Indicators of Compromise
- HTTP requests containing Content-Disposition or Content-Type headers with the same parameter name repeated, such as two filename=, charset=, or boundary= tokens.
- Uploaded files whose stored extension differs from the extension recorded by the upstream validator or web application firewall.
- Application logs showing filename mismatches between validation middleware and disk-write operations.
Detection Strategies
- Inspect access logs and reverse-proxy captures for duplicate parameters within a single Content-* header value.
- Compare filenames observed at ingress (WAF, load balancer) with filenames written by the application to identify parsing divergence.
- Add unit tests or runtime assertions that reject headers containing duplicate parameter names before they reach @hapi/content.
Monitoring Recommendations
- Alert on newly written files with server-executable extensions such as .php, .jsp, or .aspx in upload directories.
- Monitor Node.js dependency inventories for @hapi/content versions below 6.0.2 using software composition analysis.
- Track outbound child-process executions from web application processes that handle uploads.
How to Mitigate CVE-2026-44974
Immediate Actions Required
- Upgrade @hapi/content to version 6.0.2 or later across all services and transitive dependencies.
- Audit upload endpoints for reliance on filename allowlists parsed from Content-Disposition headers.
- Reject any inbound HTTP request whose Content-* headers contain duplicate parameter names at the proxy or WAF tier.
Patch Information
The fix is delivered in @hapi/content6.0.2. See the GitHub Security Advisory GHSA-36hh-x5p5-jgc8 and the GitHub Commit 3850079 for the code changes that add strict parameter validation and reject duplicates.
Workarounds
- Deploy a pre-parser or WAF rule that drops requests containing duplicate parameters in Content-Disposition and Content-Type headers.
- Enforce filename validation on the final resolved filename after @hapi/content parsing, not on the raw header value.
- Restrict upload directories to non-executable storage and validate content type by inspecting file bytes rather than trusting header metadata.
# Update @hapi/content to the fixed version
npm install @hapi/content@^6.0.2
# Verify installed version
npm ls @hapi/content
# Audit for known advisories
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
