3vulnerabilities
- Critical0 (0.0%)
- High2 (66.7%)
- Medium0 (0.0%)
- Moderate1 (33.3%)
- Low0 (0.0%)
fastify-busboy
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 3 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting fastify-busboy, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-gxm5-99cw-xjw9 | Moderate | @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name### Impact `@fastify/busboy` 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed `Content-Disposition` parameters returned to the application. The multipart header parser ends a header line only on the two-byte `\r\n` sequence, so a lone CR or LF embedded in a part header is carried verbatim into the `filename` and field `name` delivered by the `file` and `field` events. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character. An attacker who uploads a file whose `filename` or field `n |
| GitHub (opens in a new tab) | |
| GHSA-x8mw-p69m-v3mx | High | @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header### Impact Versions of `@fastify/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named `__proto__` or `constructor` resolves to an inherited value that is not an array, and the parser throws `TypeError: this.header[h].push is not a function`. Through the documented `req.pipe(busboy)` integration this surfaces as an `error` event, while direct `write()`/`end()` usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before applic |
| GitHub (opens in a new tab) | |
| GHSA-xjh9-v7x6-24jw | High | @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary### Impact Versions of `@fastify/busboy` from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a `Uint8Array(256)`. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted request keeps the search in a CPU-bound loop and stalls the Node.js event loop. An unauthenticated client can trigger this with a single small request. Applications that use `@fastify/busboy` to parse multipart/form-data, directly or through `@fastify/multipart`, are |
| GitHub (opens in a new tab) |
- GHSA-gxm5-99cw-xjw9Moderate@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
< 3.2.2
### Impact `@fastify/busboy` 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed `Content-Disposition` parameters returned to the application. The multipart header parser ends a header line only on the two-byte `\r\n` sequence, so a lone CR or LF embedded in a part header is carried verbatim into the `filename` and field `name` delivered by the `file` and `field` events. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character. An attacker who uploads a file whose `filename` or field `n
CVE: CVE-2026-74866
- GHSA-x8mw-p69m-v3mxHigh@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
>= 1.0.0, < 3.2.1
### Impact Versions of `@fastify/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named `__proto__` or `constructor` resolves to an inherited value that is not an array, and the parser throws `TypeError: this.header[h].push is not a function`. Through the documented `req.pipe(busboy)` integration this surfaces as an `error` event, while direct `write()`/`end()` usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before applic
CVE: CVE-2026-19481
- GHSA-xjh9-v7x6-24jwHigh@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
>= 3.1.0, < 3.2.1
### Impact Versions of `@fastify/busboy` from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a `Uint8Array(256)`. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted request keeps the search in a CPU-bound loop and stalls the Node.js event loop. An unauthenticated client can trigger this with a single small request. Applications that use `@fastify/busboy` to parse multipart/form-data, directly or through `@fastify/multipart`, are
CVE: CVE-2026-19484