GHSA-36hh-x5p5-jgc8
NoneCVSS
—
EPSS
—
Published
May 27, 2026
CISA due date
—
The record
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hapi/content | 0 | 6.0.2 |
Related vulnerabilities
- CVE-2026-44974 @hapi/content header parser has a parameter smuggling issue that allows upload-filter… Same vulnerability
- CVE-2026-35213 @hapi/content provided HTTP Content-* headers parsing. Also affects @hapi/content
- GHSA-jg4p-7fhp-p32p @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing Also affects @hapi/content
- GHSA-3wqh-h42r-x8fq Denial of Service in @hapi/content Also affects @hapi/content
- CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that… CWE-436
- CVE-2026-93750 http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the… CWE-436
- CVE-2026-82537 Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows… CWE-436
- CVE-2026-81378 Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a… CWE-436