@hapi/content versions before 6.0.2 have a parsing inconsistency in handling duplicate HTTP Content-* header parameters. Content.disposition() retains the last duplicate parameter, whereas Content.type() retains the first for charset and boundary parameters. This discrepancy can be exploited as a parameter-smuggling primitive when other components in the request chain resolve duplicates differently. An attacker can bypass filename allowlists in Content-Disposition headers by including multiple filename parameters, potentially allowing unauthorized file uploads. The vulnerability is addressed in version 6.0.2.

The vulnerability allows an attacker to bypass upload filename allowlists by exploiting inconsistent parsing of duplicate parameters in HTTP headers. This can lead to unauthorized file uploads with malicious filenames, increasing the risk of server compromise or unauthorized code execution. The CVSS 4.0 score of 7.7 (high severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and significant impact on integrity and security.

Upgrade to @hapi/content version 6.0.2 or later, where this issue is fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated but the fix is included in version 6.0.2, so upgrading to this version or newer is recommended.