CVE-2026-44974 Details

A parameter smuggling vulnerability has been identified in the @hapi/content package, specifically in versions prior to 6.0.2. The issue arises from inconsistent handling of duplicate parameters in HTTP Content headers. The Content.disposition() method retains the last occurrence of each parameter, while Content.type() keeps the first occurrence of duplicate charset and boundary parameters. This discrepancy can be exploited when another component in the request-processing chain resolves duplicates in the opposite manner, creating a parameter-smuggling primitive. The primary exploitation vector involves bypassing upload filename allowlists by manipulating headers such as Content-Disposition.

Users are advised to update to @hapi/content version 6.0.2 or later, and to validate headers for duplicate parameters before or after processing.