Nixpkgs security tracker

Permalink CVE-2026-44974

7.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 6 days, 15 hours ago Activity log

Created suggestion 6 days, 15 hours ago

Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters

@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name="file"; filename="safe.txt"; filename="shell.php". This issue is fixed in version 6.0.2.

References

https://github.com/hapijs/content/security/advisories/GHSA-36hh-x5p5-jgc8 x_refsource_CONFIRM
https://github.com/hapijs/content/commit/3850079550c191d25e3643dc82a6d61144db8c2f x_refsource_MISC

Affected products

content

==< 6.0.2

Matching in nixpkgs

pkgs.malcontent

Parental controls library

nixos-unstable 0.13.1
- nixpkgs-unstable 0.13.1
- nixos-unstable-small 0.13.1
nixos-26.05 0.13.1
- nixos-26.05-small 0.13.1
- nixpkgs-26.05-darwin 0.13.1

pkgs.jazz2-content

Assets needed for jazz2

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.malcontent-ui

UI components for parental controls library

nixos-unstable 0.13.1
- nixpkgs-unstable 0.13.1
- nixos-unstable-small 0.13.1
nixos-26.05 0.13.1
- nixos-26.05-small 0.13.1
- nixpkgs-26.05-darwin 0.13.1

pkgs.lomiri.content-hub

Content sharing/picking service for the Lomiri desktop

nixos-unstable 2.2.3
- nixpkgs-unstable 2.2.3
- nixos-unstable-small 2.2.3
nixos-26.05 2.2.3
- nixos-26.05-small 2.2.3
- nixpkgs-26.05-darwin 2.2.3

pkgs.lomiri.lomiri-content-hub

Content sharing/picking service for the Lomiri desktop

nixos-unstable 2.2.3
- nixpkgs-unstable 2.2.3
- nixos-unstable-small 2.2.3
nixos-26.05 2.2.3
- nixos-26.05-small 2.2.3
- nixpkgs-26.05-darwin 2.2.3

pkgs.lomiri-qt6.lomiri-content-hub

Content sharing/picking service for the Lomiri desktop

nixos-unstable 2.2.3
- nixpkgs-unstable 2.2.3
- nixos-unstable-small 2.2.3
nixos-26.05 2.2.3
- nixos-26.05-small 2.2.3
- nixpkgs-26.05-darwin 2.2.3

pkgs.perlPackages.TestFileContents

Test routines for examining the contents of files

nixos-unstable 0.242
- nixpkgs-unstable 0.242
- nixos-unstable-small 0.242
nixos-26.05 0.242
- nixos-26.05-small 0.242
- nixpkgs-26.05-darwin 0.242

pkgs.perl5Packages.TestFileContents

Test routines for examining the contents of files

nixos-unstable 0.242
- nixpkgs-unstable 0.242
- nixos-unstable-small 0.242
nixos-26.05 0.242
- nixos-26.05-small 0.242
- nixpkgs-26.05-darwin 0.242

pkgs.perlPackages.EmailMIMEContentType

Parse and build a MIME Content-Type or Content-Disposition Header

nixos-unstable 1.028
- nixpkgs-unstable 1.028
- nixos-unstable-small 1.028
nixos-26.05 1.028
- nixos-26.05-small 1.028
- nixpkgs-26.05-darwin 1.028

pkgs.haskellPackages.directory-contents

Recursively build, navigate, and operate on a tree of directory contents

nixos-unstable 0.2.0.3
- nixpkgs-unstable 0.2.0.3
- nixos-unstable-small 0.2.0.3
nixos-26.05 0.2.0.3
- nixos-26.05-small 0.2.0.3
- nixpkgs-26.05-darwin 0.2.0.3