fastify-multipart CVE-2026-18549

Three conditions must hold simultaneously for exploitation to succeed. First, the target application must use @fastify/multipart at a version between 5.3.0 and 10.1.0 inclusive. Second, the application (or plugin configuration) must have a busboy fileSize limit set - without this limit, truncation cannot occur and the defective code path is not reached. Third, the attacker must be able to reach the multipart upload endpoint and abruptly terminate the TCP connection after upload begins; the CVSS vector (PR:N, AV:N, AC:L) confirms no authentication is required and no special network positioning is needed. Exploitation is constrained to a Denial of Service outcome - there is no path to data exfiltration or code execution. Applications that enforce authentication before any upload endpoint face a materially reduced attack surface, as authenticated exploitation would require valid credentials and is far harder to sustain at the volume needed for exhaustion.

The CVSS 3.1 score of 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the network-reachable, zero-authentication, low-complexity nature of this attack. Impact is strictly availability - confidentiality and integrity are unaffected - but the availability impact is rated High because repeated exploitation produces unbounded accumulation of both leaked temp files and hung event-loop tasks, which can bring a Node.js process to a halt. The attack is mechanically simple: any HTTP client can trigger it with a deliberately oversized upload followed by an abrupt TCP reset, requiring no special knowledge of the target application. The critical exploitation precondition is that a busboy fileSize limit must be configured by the application developer; without one, the truncation that initiates the defective code path cannot occur. This somewhat narrows the attack surface relative to the raw CVSS score, since not all deployments enforce file size limits. No EPSS data was provided in the source intelligence; no KEV listing and no public proof-of-concept exist at time of analysis, meaning exploitation is theoretical but straightforward. For services that accept unauthenticated file uploads - such as public document ingestion APIs or anonymous form submissions - this is a genuine operational risk warranting prompt patching. For services where file upload endpoints are gated behind authentication, the risk is considerably lower but still present.

An attacker targets a publicly accessible Fastify API that accepts file uploads and has a busboy fileSize limit configured. The attacker sends repeated HTTP POST requests with multipart/form-data bodies containing a file payload that exceeds the configured size limit, then forcibly resets the TCP connection (e.g., via RST packet) immediately after busboy truncates the file - before the terminating MIME boundary is transmitted. Each aborted request leaves one orphaned temporary file on the server's disk and one unresolved Promise consuming an event-loop slot, causing progressive resource leakage until the server becomes unresponsive.