CVE-2026-44974

🗓️ 17 Jul 2026 20:11:44Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 108 Views🌐 WEB

Header parameter smuggling in @hapi/content may bypass upload filename allowlists; fixed in six zero two.

Reporter	Title	Published	Views	Family All 57
attackerkb	CVE-2026-44974	17 Jul 202620:11	–	attackerkb
Chainguard	CVE-2026-44974 vulnerabilities	29 May 202601:17	–	cgr
Cvelist	CVE-2026-44974 Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters	17 Jul 202620:11	–	cvelist
EUVD	EUVD-2026-45313	17 Jul 202620:11	–	euvd
Github Security Blog	@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters	27 May 202600:37	–	github
Mend	CVE-2026-44974	17 Jul 202620:11	–	mend
NVD	CVE-2026-44974	17 Jul 202620:17	–	nvd
osv_cga	CGA-3PMR-239G-H8C3	27 May 202611:22	–	osv_cga
osv_cga	CGA-42JR-5WPM-J24Q	27 May 202612:29	–	osv_cga
osv_cga	CGA-4M7C-G9PQ-73GV	27 May 202612:21	–	osv_cga

Vulners

Node

spumko_project hapi_server_frameworkRange<6.0.2

[
  {
    "vendor": "hapijs",
    "product": "content",
    "versions": [
      {
        "version": "< 6.0.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8
github	www.github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f

Parameter	Position	Path	Description	CWE
Content-Disposition	header	/?Content-Disposition=form-data; name="file"; filename="safe.txt"; filename="shell.php"	Parameter smuggling in Content-Disposition header due to inconsistent handling of duplicate filename parameters, potentially leading to upload filename allowlist bypass.	CWE-436

23 Jul 2026 16:10Current

6Medium risk

Vulners AI Score6

CVSS 47.7

EPSS0.00472

SSVC

CWE-436