Multipart Form-Data Parser Vulnerability in Fastify by Fastify

CVE-2026-18549

What is CVE-2026-18549?

The @fastify/multipart library, which serves as a multipart form-data parser for Fastify, exhibits a critical flaw in its handling of the busboy fileSize limit. In versions ranging from 5.3.0 to just below 10.1.1, when a file part is truncated, the plugin erroneously clears its reference to the current file while the stream remains active. If a client aborts the connection before sending the necessary terminating boundary, the cleanup process fails to locate an active stream to dismantle, leading to persistent hanging states in request handlers. Consequently, this behavior allows an unauthenticated client to exploit the flaw, resulting in potential leakage of temporary files and saturation of server resources, including disk space and event-loop capacity. To rectify this issue, it is imperative for users to upgrade to version 10.1.1.

References