GHSA-x8mw-p69m-v3mx

Dashboard / Vulnerabilities / GHSA-x8mw-p69m-v3mx

GHSA-x8mw-p69m-v3mx

Summary: @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Details: ### Impact Versions of `@fastify/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named `__proto__` or `constructor` resolves to an inherited value that is not an array, and the parser throws `TypeError: this.header[h].push is not a function`. Through the documented `req.pipe(busboy)` integration this surfaces as an `error` event, while direct `write()`/`end()` usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected. ### Patches Fixed in version 3.2.1. ### Workarounds Attach an `error` listener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap direct `write()`/`end()` calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.

References: https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx, https://nvd.nist.gov/vuln/detail/CVE-2026-19481, https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b, https://cna.openjsf.org/security-advisories.html, https://github.com/fastify/busboy, https://github.com/fastify/busboy/releases/tag/v3.2.1