PT-2026-43630 · Npm+3 · @Hapi/Content+2

CVE-2026-44974 · Published 2026-05-27 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions @rootio/hapi content versions prior to 6.0.2

Description Inconsistent duplicate parameter resolution in the Content.disposition() and Content.type() functions creates a parameter-smuggling primitive. While Content.disposition() retains the last occurrence of each parameter, Content.type() retains the first occurrence of charset and boundary. This discrepancy can be exploited when other components in the request-processing chain, such as a WAF or reverse proxy, resolve duplicates differently, potentially allowing an upload filename allowlist bypass.

Recommendations Update to version 6.0.2. Pre or post validate headers to check for duplicates.

Exploit

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2026-44974

GHSA-36HH-X5P5-JGC8

Affected Products

@Hapi/Content

@Rootio/Hapi Content

Acontent

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44974.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44974 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44974 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-36hh-x5p5-jgc8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44974 · Vendor Advisory
• https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8 · Note
• https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f · Note
• https://github.com/hapijs/content · Note
• https://reddit.com/r/VulnMatter/comments/1tp6u1g/resumen_diario_de_vulnerabilidades_27052026 · Reddit Post
• https://t.me/cveNotify/208409 · Telegram Post