MIME Type Bypass Vulnerability in Nhost Storage Service

CVE-2026-33221

What is CVE-2026-33221?

Nhost, an open-source alternative to Firebase that utilizes GraphQL, experienced a vulnerability in its storage service prior to version 0.12.0. The issue arises from the file upload handler's trust in the client-supplied Content-Type header, allowing attackers to bypass server-side MIME type restrictions. This could enable malicious users to upload files with arbitrary MIME types, potentially leading to unauthorized access or exploitation of the system. The vulnerability has been addressed in version 0.12.0, which implements proper MIME type detection to enhance security.

References