CVE-2026-33221CWE-343CWE-345

Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

Low · published March 20, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00173 · 6.9th percentile
Weaknesses
CWE-343 · Predictable Value Range from Previous Values; CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-03-20T23:00Z
EPSS history
Timeline
  • 20 MAR 23:00Z
    Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload
    cvelistv5