CVE-2026-33221 Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-33221?
CVE-2026-33221 is a low-severity vulnerability in nhost, published on 20 Mar 2026.
Official description
Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0.
Which versions are affected by CVE-2026-33221?
3 open source packages ship an affected version, including github.com/nhost/nhost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nhost/nhost Go | All versions | 0.0.0-20260318074820-c4bd53f042d7 |
github.com/nhost/nhost Go | All versions | 0.0.0-20260318074820-c4bd53f042d7 |
github.com/nhost/nhost Go | All versions | 0.0.0-20260318074820-c4bd53f042d7 |
Products include Nhost Storage.
How do I fix CVE-2026-33221?
Upgrade github.com/nhost/nhost to 0.0.0-20260318074820-c4bd53f042d7 or later.
Is CVE-2026-33221 being exploited?
There is no known exploitation of CVE-2026-33221 in the wild and no public exploit code.
Sources
Also known as GHSA-g9f6-9775-hffm, GO-2026-4759.