The vulnerability is a parameter‑smuggling flaw in @hapi/content's HTTP header parser. Prior to version 6.0.2, the Content.disposition() parser kept the last duplicate occurrence of each header parameter, whereas Content.type() retained the first duplicate for charset and boundary parameters. This inconsistent handling creates a primitive that can be exploited when another component of the request‑processing chain resolves duplicate parameters differently. An attacker can craft a Content‑Disposition header containing duplicate filename parameters such as "file="safe.txt"; filename="shell.php". Because the parser ultimately keeps the last duplicate, the malicious filename bypasses the upload allowlist, enabling the controlled upload of files that should otherwise be rejected. The issue is fixed in version 6.0.2.

The affected product is hapijs:content, used in the Hapi.js framework. Versions older than 6.0.2 are vulnerable; the issue is fixed in version 6.0.2 and later.

The CVSS score of 7.7 indicates a high severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation at the time of analysis. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to send a specially crafted HTTP request with duplicate Content‑Disposition parameters, which can be performed over the network from an unauthenticated source. The impact is limited to environments that allow file uploads without additional server‑side validation independent of the header parser.