Fastify Busboy
Monthly
CPU exhaustion in @fastify/busboy 3.1.0-3.2.0 allows a remote unauthenticated attacker to stall the Node.js event loop by sending a single crafted multipart request. The parser's vendored streaming search algorithm stores its Boyer-Moore-style skip table in a fixed 256-entry byte array; supplying a boundary of exactly 252 bytes causes the computed search needle to reach 256 bytes, collapsing the skip distance to zero and converting an O(n) search into an unbounded CPU-bound loop. Because Node.js is single-threaded and event-driven, one stalled core prevents all other requests from being processed by the same worker, achieving denial of service with minimal bandwidth. No public exploit has been identified at time of analysis, but the attack primitive is trivially reproducible from the advisory.
Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.
CRLF injection in @fastify/busboy's multipart part-header parser allows unauthenticated remote attackers to embed bare carriage return or line feed characters into parsed Content-Disposition filenames and field names, which are then handed to applications as if they were clean values. All versions through 3.2.1 are affected; the fix is in 3.2.2. When applications forward these tainted values to CR/LF-sensitive sinks - HTTP response headers, log systems, or filesystem paths - attackers can achieve log forging, HTTP header injection, or filesystem filename pollution. No public exploit or CISA KEV listing has been identified at time of analysis.
CPU exhaustion in @fastify/busboy 3.1.0-3.2.0 allows a remote unauthenticated attacker to stall the Node.js event loop by sending a single crafted multipart request. The parser's vendored streaming search algorithm stores its Boyer-Moore-style skip table in a fixed 256-entry byte array; supplying a boundary of exactly 252 bytes causes the computed search needle to reach 256 bytes, collapsing the skip distance to zero and converting an O(n) search into an unbounded CPU-bound loop. Because Node.js is single-threaded and event-driven, one stalled core prevents all other requests from being processed by the same worker, achieving denial of service with minimal bandwidth. No public exploit has been identified at time of analysis, but the attack primitive is trivially reproducible from the advisory.
Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.
CRLF injection in @fastify/busboy's multipart part-header parser allows unauthenticated remote attackers to embed bare carriage return or line feed characters into parsed Content-Disposition filenames and field names, which are then handed to applications as if they were clean values. All versions through 3.2.1 are affected; the fix is in 3.2.2. When applications forward these tainted values to CR/LF-sensitive sinks - HTTP response headers, log systems, or filesystem paths - attackers can achieve log forging, HTTP header injection, or filesystem filename pollution. No public exploit or CISA KEV listing has been identified at time of analysis.