@fastify/multipart CVE-2026-19474

Exploitation requires that the target Fastify application calls request.saveRequestFiles() from @fastify/multipart on at least one HTTP endpoint - applications using streaming mode or in-memory buffers instead of saveRequestFiles() are not affected even if they run a vulnerable version. The upload endpoint must accept connections from unauthenticated clients, consistent with the PR:N CVSS metric; if authentication is enforced at the application or gateway layer before multipart parsing, the practical attack surface is reduced to authenticated users (who may still abuse it for insider DoS). The attacker must be able to initiate and abruptly terminate TCP connections to the target - standard capability for any internet client. The version must fall within 3.0.0 to <10.1.1. No non-default configuration setting is required; the vulnerability manifests in the default file-saving code path whenever multiple parts are present in a single upload.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-supported by the mechanics: any internet-accessible Fastify endpoint that calls request.saveRequestFiles() is exploitable without authentication, credentials, or special client state. The attack is fully automatable - a client sends a crafted multipart request and terminates the TCP connection between parts; this loop requires only standard HTTP tooling and no reverse engineering of application logic. The impact is strictly availability, with disk exhaustion potentially cascading to broader service failure in containerized or shared-storage environments. No EPSS score was included in the intelligence data, so probabilistic exploitation likelihood cannot be quantified here; however, the low attack complexity and zero authentication requirement suggest exploitation probability would be non-trivial if this CVE received wider attention. The CVE is not listed in CISA KEV, and no public exploit code was referenced in the advisory - exploitation appears opportunistic rather than confirmed active. The incomplete-fix lineage from CVE-2025-24033 is a notable risk amplifier: threat actors who targeted the prior CVE may already understand the attack surface and test the residual gap. Even a mid-sized municipal IT team in inowroclaw operating a public-facing Fastify file-upload service should treat this as urgent given the zero-barrier exploitation path. The sole mitigating factor is deployment specificity: only applications using the saveRequestFiles() API path are vulnerable, which narrows the effective exposure compared to the raw CVSS score might suggest.

An unauthenticated attacker sends a multipart/form-data request with two or more parts to any exposed Fastify endpoint that calls request.saveRequestFiles(), deliberately closing the TCP connection after the first part is written to disk but before the iterator advances to process the second. Each such disconnection permanently orphans the temporary file from the completed part. The attacker scripts this loop - achievable with curl, Python requests, or any HTTP library - sending hundreds of such requests per minute, causing the server's temporary storage to fill progressively until the filesystem is exhausted and the application crashes or becomes unavailable. No public exploit code has been identified at time of analysis, but no specialized tooling is required.