CVE-2026-18549

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cna.openjsf.org/security-advisories.html	Third Party Advisory
https://github.com/fastify/fastify-multipart/security/advisories/GHSA-vmph-573x-85f6	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fastify:fastify-multipart:*:*:*:*:*:fastify:*:*

History

No history.

Information

Published : 2026-08-15 14:17

Updated : 2026-09-02 15:13

NVD link : CVE-2026-18549

Mitre link : CVE-2026-18549

CVE.ORG link : CVE-2026-18549

JSON object : View

Products Affected

fastify

fastify-multipart

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-664

Improper Control of a Resource Through its Lifetime

{"id": "CVE-2026-18549", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18549", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T19:43:46.284783Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "@fastify/multipart", "product": "@fastify/multipart", "versions": [{"status": "affected", "version": "5.3.0", "lessThan": "10.1.1", "versionType": "semver"}, {"status": "unaffected", "version": "10.1.1", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/multipart", "defaultStatus": "unaffected"}]}], "published": "2026-08-15T14:17:07.590", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Third Party Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/fastify-multipart/security/advisories/GHSA-vmph-573x-85f6", "tags": ["Mitigation", "Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-664"}]}], "descriptions": [{"lang": "en", "value": "@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1."}], "lastModified": "2026-09-02T15:13:16.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify-multipart:*:*:*:*:*:fastify:*:*", "vulnerable": true, "matchCriteriaId": "ECE54AB5-BC6F-4FF5-96E4-0991D1177451", "versionEndExcluding": "10.1.1", "versionStartIncluding": "5.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}