CVE-2026-74866

{"id": "CVE-2026-74866", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74866", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T12:35:38.937723Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "@fastify/busboy", "product": "@fastify/busboy", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.2", "versionType": "semver"}, {"status": "unaffected", "version": "3.2.2", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/busboy", "defaultStatus": "unaffected"}]}], "published": "2026-08-21T09:16:40.890", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Third Party Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix."}, {"lang": "es", "value": "@fastify/busboy es un analizador de datos de formulario multipart para Node.js. Su analizador de encabezados de parte multipart divide las l\u00edneas de encabezado solo en la secuencia de dos bytes de retorno de carro y salto de l\u00ednea, por lo que un retorno de carro o salto de l\u00ednea solitario incrustado en un encabezado de parte no se trata como un salto de l\u00ednea y se transfiere textualmente al nombre de archivo y nombre de campo de Content-Disposition analizados entregados a la aplicaci\u00f3n. Un atacante que carga un archivo cuyo nombre de archivo o nombre de campo contiene un retorno de carro o salto de l\u00ednea simple puede inyectar caracteres de control en consumidores que conf\u00edan en que el analizador devuelva valores limpios, lo que permite la contaminaci\u00f3n de nombres de archivo del sistema de archivos, la falsificaci\u00f3n de registros o la inyecci\u00f3n de encabezados cuando el valor se reenv\u00eda a un sumidero sensible al retorno de carro. Todas las versiones de @fastify/busboy hasta la 3.2.1 inclusive est\u00e1n afectadas. El problema est\u00e1 solucionado en la versi\u00f3n 3.2.2, la cual rechaza cualquier l\u00ednea de encabezado que a\u00fan contenga un retorno de carro o salto de l\u00ednea simple. Los usuarios deben actualizar a la versi\u00f3n 3.2.2, y los consumidores, como @fastify/multipart, deben actualizar su dependencia de @fastify/busboy para incorporar la soluci\u00f3n."}], "lastModified": "2026-10-16T15:10:00.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify\\/busyboy:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "A25AE22C-04F1-4E0C-88E8-95AD11012889", "versionEndExcluding": "3.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}