Denial of Service Vulnerability in @fastify/busboy Multipart Parser

CVE-2026-19484

What is CVE-2026-19484?

The @fastify/busboy multipart form-data parser, used in Node.js applications, contains a vulnerability where a remote unauthenticated attacker can manipulate the event loop through specifically crafted multipart requests. If the boundary of the request is set to exactly 252 bytes, it leads to a CPU-bound loop that can stall the server, denying service to other requests. This issue arises from the limited size of the skip table in the parser, where a certain boundary size truncates the skip distance. To mitigate this vulnerability, users should upgrade to version 3.2.1, which expands the skip table size and preserves the skip distance during parsing.

References