File Upload Plugin Vulnerability in Fastify Framework by Fastify
CVE-2026-117531

5.9MEDIUM

Key Information:

Vendor

@fastify/multipart

Status
@fastify/multipart
Vendor
CVE Published:
2 November 2026

What is CVE-2026-117531?

The multipart file upload plugin for Fastify has a vulnerability that can lead to server resource exhaustion. In versions 5.3.0 through 10.1.6, the plugin fails to propagate parser errors to the file stream when aberrant requests are made. This allows unauthenticated remote clients to repeatedly upload malformed requests, which can accumulate pending connections and exhaust server resources. This vulnerability is mitigated in version 10.1.7 where errors are now correctly propagated. Users are urged to upgrade to this version or later to ensure proper error handling and to avoid potential issues.

Affected Version(s)

@fastify/multipart 5.3.0 < 10.1.7

@fastify/multipart 10.1.7

References

https://github.com/fastify/fastify-multipart/security/adv...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

fifoqueue
mcollina
UlisesGascon
.