Fastify Multipart
Monthly
Disk exhaustion via orphaned temporary files in @fastify/multipart versions 3.0.0 through 10.1.0 allows unauthenticated remote clients to cause persistent denial of service against Fastify applications that use the `request.saveRequestFiles()` API. The defect is an incomplete fix of CVE-2025-24033: while the per-file cleanup path was previously patched, the iterator rejection raised between multipart parts falls outside that cleanup scope, leaving already-completed temporary files permanently on disk. Repeated client disconnections mid-upload cause linear, unbounded disk consumption that can exhaust storage and render the host or container unavailable. No public exploit identified at time of analysis, but the attack is trivially automatable given the unauthenticated, low-complexity network vector.
Uncontrolled resource consumption in @fastify/multipart (versions 5.3.0 through 10.1.0) allows any unauthenticated remote client to permanently leak temporary files on disk and suspend Fastify request handler executions, ultimately exhausting both disk space and the Node.js event loop. The root defect is a state-management flaw: when busboy's fileSize limit truncates an incoming file part, the plugin prematurely clears its internal stream reference, so a subsequent client-initiated abort finds nothing to clean up, leaving saveRequestFiles() awaiting a settlement that never arrives. No public exploit code has been identified at the time of analysis, but the attack is trivially repeatable with standard HTTP tooling, making this a realistic denial-of-service risk for any service that accepts multipart file uploads from untrusted clients.
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Disk exhaustion via orphaned temporary files in @fastify/multipart versions 3.0.0 through 10.1.0 allows unauthenticated remote clients to cause persistent denial of service against Fastify applications that use the `request.saveRequestFiles()` API. The defect is an incomplete fix of CVE-2025-24033: while the per-file cleanup path was previously patched, the iterator rejection raised between multipart parts falls outside that cleanup scope, leaving already-completed temporary files permanently on disk. Repeated client disconnections mid-upload cause linear, unbounded disk consumption that can exhaust storage and render the host or container unavailable. No public exploit identified at time of analysis, but the attack is trivially automatable given the unauthenticated, low-complexity network vector.
Uncontrolled resource consumption in @fastify/multipart (versions 5.3.0 through 10.1.0) allows any unauthenticated remote client to permanently leak temporary files on disk and suspend Fastify request handler executions, ultimately exhausting both disk space and the Node.js event loop. The root defect is a state-management flaw: when busboy's fileSize limit truncates an incoming file part, the plugin prematurely clears its internal stream reference, so a subsequent client-initiated abort finds nothing to clean up, leaving saveRequestFiles() awaiting a settlement that never arrives. No public exploit code has been identified at the time of analysis, but the attack is trivially repeatable with standard HTTP tooling, making this a realistic denial-of-service risk for any service that accepts multipart file uploads from untrusted clients.
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.