Multipart Form-Data Parser Vulnerability in @fastify/busboy by Fastify

CVE-2026-74866

What is CVE-2026-74866?

The @fastify/busboy library, a multipart form-data parser for Node.js, is susceptible to a vulnerability where the part-header parser erroneously handles lone carriage return or line feed characters. This flaw allows an attacker to upload files containing bare carriage returns or line feeds in filenames or field names. As a result, control characters can be injected into applications that trust the parser's output, leading to issues such as filesystem filename pollution, log forging, or header injection in environments sensitive to carriage returns. The issue has been corrected in version 3.2.2 of @fastify/busboy, which ensures that any header line containing bare carriage returns or line feeds is rejected during parsing. Users are advised to upgrade to this version to mitigate the risks.

References