@fastify/busboy CVE-2026-74866

The application must accept multipart/form-data uploads handled by @fastify/busboy version 3.2.1 or earlier, and must subsequently forward the parsed filename or field name to a carriage-return-or-line-feed-sensitive sink - such as an HTTP response header, a log writer that treats newlines as record separators, or a filesystem path constructor. Exploitation is unauthenticated (PR:N) and requires no user interaction. The limiting factor is the downstream sink: if the application never reflects or logs the raw filename value, there is no exploitable path despite the parser flaw. Deployments that validate or sanitize field names and filenames at the application layer before use are also substantially protected.

The CVSS 3.1 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) accurately captures the network-reachable, zero-prerequisites nature of the flaw, though the low integrity rating may understate real-world impact in deployments that forward filenames directly into HTTP responses or structured log pipelines. No EPSS data was supplied, and the vulnerability is not listed in CISA KEV, suggesting it has not yet been observed in active campaigns. The practical severity is heavily context-dependent: an application that writes the raw filename into a log or reflects it in a Content-Disposition response header is meaningfully exposed, while one that never surfaces the value beyond its own internal processing faces minimal risk. The absence of a POC and KEV listing argues against treating this as an emergency for most teams, but the zero-privilege, network-accessible attack vector means that any deployment where the filename flows into a CR/LF-sensitive sink should prioritize the upgrade to 3.2.2. No conflicting signals exist in the available data - CVSS vector and description are consistent.

An attacker sends a multipart/form-data HTTP POST request to a Fastify endpoint where the file upload part's Content-Disposition header contains a filename with an embedded bare line feed - for example, filename="report\nX-Injected-Header: evil". The @fastify/busboy parser passes this tainted string to the application unchanged. If the application echoes the filename in an HTTP response header or appends it to an application log line, the injected \n causes header splitting or log record forging. No public POC has been identified, but the attack requires only a crafted HTTP request and no authentication.