Denial of Service Vulnerability in @fastify/busboy Multipart Form-Data Parser

CVE-2026-19481

What is CVE-2026-19481?

The @fastify/busboy library, utilized for parsing multipart form-data in Node.js applications, exhibits a vulnerability that allows attackers to disrupt service. Versions from 1.0.0 to 3.2.0 are affected due to improper handling of prototype-inherited properties such as proto or constructor within multipart headers. When attackers craft payloads with these inherited properties, they can trigger a TypeError during processing, potentially causing a denial of service by crashing the Node.js process. This vulnerability has been addressed in version 3.2.1, where the library now creates the header object with a null prototype to mitigate the issue. It is crucial for users to upgrade to the latest version to ensure application stability and security.

References