Skip to main content

@fastify/busboy CVE-2026-19484

| EUVDEUVD-2026-57759 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-08-13 openjs GHSA-xjh9-v7x6-24jw
Denial Of Service Node.js Fastify Busboy
7.5
CVSS 3.1 · Vendor: openjs
Share

Severity by source

Vendor (openjs) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Attacker fully controls boundary length in their own request, so AC:L; no authentication per PR:N; only availability impacted.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 10:01 EUVD
Analysis Generated
Aug 13, 2026 - 09:51 vuln.today
CVE Published
Aug 13, 2026 - 08:50 cve.org
HIGH 7.5

DescriptionCVE.org

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.

Articles & Coverage 2

News 7 New Node.js Vulnerabilities - 1 Critical, 6 High, 4 With POC Aug 14, 2026 News 3 New Node.js Vulnerabilities - 1 Critical, 2 High Severity Aug 13, 2026

AnalysisAI

CPU exhaustion in @fastify/busboy 3.1.0-3.2.0 allows a remote unauthenticated attacker to stall the Node.js event loop by sending a single crafted multipart request. The parser's vendored streaming search algorithm stores its Boyer-Moore-style skip table in a fixed 256-entry byte array; supplying a boundary of exactly 252 bytes causes the computed search needle to reach 256 bytes, collapsing the skip distance to zero and converting an O(n) search into an unbounded CPU-bound loop. Because Node.js is single-threaded and event-driven, one stalled core prevents all other requests from being processed by the same worker, achieving denial of service with minimal bandwidth. No public exploit has been identified at time of analysis, but the attack primitive is trivially reproducible from the advisory.

Technical ContextAI

The affected library, identified by CPE cpe:2.3:a:@fastify/busboy:@fastify/busboy:*:*:*:*:*:*:*:*, is the Fastify project's fork of the Node.js busboy multipart/form-data parsing library. It implements an internal streaming search routine to locate MIME boundary markers within incoming request bodies. The search uses a precomputed skip table of 256 entries (one per possible byte value) to enable fast skipping - conceptually similar to the bad-character table in Boyer-Moore-Horspool. The bug (CWE-835: Loop with Unreachable Exit Condition) arises because the skip table is allocated as a fixed 256-entry array while the search needle length is derived from the boundary plus framing characters. When the caller supplies a boundary of exactly 252 bytes, the needle reaches exactly 256 bytes, causing an index into the skip table to wrap or truncate the stored skip distance to zero. With a skip of zero, the search cursor never advances, creating an infinite or near-infinite spin loop on even a small request body. The Node.js event loop's cooperative, single-threaded concurrency model means this CPU lock prevents the process from servicing any other I/O callbacks for the duration of the loop.

RemediationAI

The primary fix is to upgrade @fastify/busboy to version 3.2.1, which widens the internal skip table so that the skip distance is correctly preserved regardless of boundary length. The vendor advisory is available at https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw and the OpenJS Foundation advisory index at https://cna.openjsf.org/security-advisories.html. For teams that cannot upgrade immediately, a targeted compensating control is to enforce a maximum multipart boundary length at the reverse proxy or load balancer layer (e.g., reject multipart requests whose Content-Type boundary parameter exceeds 200 bytes in nginx using a map or header inspection rule); this breaks the specific 252-byte trigger condition without requiring application changes, though it may reject edge-case legitimate clients that generate unusually long boundaries. Alternatively, rate-limiting multipart POST requests per source IP reduces the attacker's ability to sustain a denial-of-service condition, but does not eliminate it. Disabling multipart body parsing entirely is only feasible if the affected route does not require file or form uploads. Upgrading to 3.2.1 remains the definitive remediation with no known side effects.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-19484 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy