@fastify/multipart CVE-2026-117531

Exploitation requires the target application to define an upload route whose handler iterates request parts via request.parts() and performs asynchronous work BEFORE consuming part.file (e.g. attaching pipeline() or toBuffer() to the file stream after an await) - this delayed-consumer pattern is the exact prerequisite named in the advisory. The attacker then sends a multipart body that ends inside a file part with no closing boundary, with a complete Content-Length, without aborting the connection and without exceeding any fileSize limit. Limiting factors: the flaw is availability-only (no data exposure or modification); it does NOT affect handlers that consume the file stream immediately or applications not using @fastify/multipart's streaming parts API; and it affects only versions 5.3.0 through 10.1.6. No authentication or user interaction is required (PR:N/UI:N).

This is a medium-severity (CVSS 5.9) availability-only denial-of-service issue in @fastify/multipart, and the signals consistently point to a real-but-conditional risk rather than an emergency. The CVSS vector (AV:N/AC:H/PR:N/UI:N) shows a network-reachable, unauthenticated flaw with no confidentiality or integrity impact and high availability impact - high attack complexity reflects that exploitation is not universal but depends on the application's code pattern. No EPSS score was supplied, the CVE is not in CISA KEV (no active exploitation confirmed), and no public exploit or PoC reference is present - only the GHSA advisory and the OpenJSF CNA page. The vuln.today decision label is 'this_month', which aligns with patch-on-a-normal-cycle urgency rather than act_now/emergency. The key limiting factor, stated explicitly in the advisory, is that the hang only occurs when a handler uses request.parts() and performs asynchronous work BEFORE consuming part.file (a delayed file consumer); applications that consume the file stream immediately are not affected. This is therefore a genuine priority for the subset of Fastify deployments using the vulnerable pattern, but a low real-world risk for the majority that do not.

An unauthenticated remote attacker sends a multipart/form-data upload to a vulnerable route where the handler iterates request.parts() and does asynchronous work before consuming the file stream. The malformed body ends inside a file part with a complete Content-Length but no closing boundary, so the plugin destroys the file stream without emitting error or end, leaving the request hanging and the connection open. The attacker repeats these requests to accumulate pending connections and exhaust server resources. No public exploit code was identified at time of analysis.