Multipart Form-Data Parser Vulnerability in Fastify by Fastify
CVE-2026-19474

7.5HIGH

Key Information:

Vendor

@fastify/multipart

Status
@fastify/multipart
Vendor
CVE Published:
15 August 2026

What is CVE-2026-19474?

The multipart form-data parser for Fastify, found in versions 3.0.0 through 10.1.0, suffers from a flaw where it fails to clean up temporary files after a client disconnects during multipart processing. This oversight allows an unauthenticated client to exploit the parser by causing persistent disk usage, potentially leading to denial of service. Users are advised to upgrade to version 10.1.1, where this issue has been resolved.

Affected Version(s)

@fastify/multipart 3.0.0 < 10.1.1

@fastify/multipart 10.1.1

References

https://github.com/fastify/fastify-multipart/security/adv...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hemanth-9087
mcollina
UlisesGascon
climba03003
.