7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44974

CVE-2026-44974: @hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters

Impact

The two parsers resolved duplicates inconsistently and silently:

Content.disposition() retained the last occurrence of each parameter.
Content.type() retained the first occurrence of charset and boundary.

Either behavior creates a parameter-smuggling primitive when another component in the request-processing chain (a WAF, reverse proxy, security filter, or alternate parser) resolves duplicates the opposite way. The primary attack vector is upload filename allowlist bypass:

Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php"

Patches

The issue has been patched in 6.0.2.

Workarounds

Pre or post validate headers looking for duplicates.

Resources

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44974

CVE-2026-44974:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@hapi/content	npm	< 6.0.2	6.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the inconsistent handling of duplicate parameters within HTTP headers by the @hapi/content library. The analysis of the patch commit 3850079550c191d25e3643dc82a6d61144db8c2f reveals the two key vulnerable functions: type and disposition.

disposition function: This function parses the Content-Disposition header. Before the patch, if a header contained duplicate parameters (e.g., filename="safe.txt"; filename="shell.php"), the function would simply overwrite the value, effectively keeping the last one seen. This created a parameter smuggling vulnerability, as a web application firewall (WAF) or proxy might interpret the header differently (e.g., by taking the first parameter), leading to a bypass of security controls like file upload filters.
type function: This function parses the Content-Type header. It had a similar issue where it would retain the first occurrence of charset and boundary parameters, silently ignoring subsequent ones. This could also lead to interpretation conflicts with other systems in the request chain.

The patch addresses these issues by adding explicit checks within both functions to detect and throw an error upon finding duplicate parameters, unless the duplication is explicitly allowed by RFC specifications (as in the case of ext-value in Content-Disposition). Therefore, any runtime profile during exploitation of this vulnerability would show traces originating from the type and disposition functions as they process the malicious headers.

Vulnerable functions

type

lib/index.js

The 'type' function was vulnerable because it did not properly handle duplicate 'charset' or 'boundary' parameters in 'Content-Type' headers. It would silently accept the first occurrence, which could lead to inconsistencies and bypass security filters if a downstream component interpreted the duplicates differently. The patch adds a check to throw an error when duplicate parameters are detected.

disposition

lib/index.js

The 'disposition' function was vulnerable because it resolved duplicate parameters in 'Content-Disposition' headers by retaining the last occurrence. This behavior could be exploited for parameter smuggling, such as bypassing file upload filters by providing multiple 'filename' parameters. The patch introduces logic to detect and reject invalid duplicate parameters, allowing only RFC-compliant overrides.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.