AIKIDO-2025-10760
@fastify/multipart is vulnerable to Denial of Service (DoS)
21
Low Risk
This Affects:
@fastify/multipartTL;DR
Affected versions of this package are vulnerable to denial-of-service (DoS) attacks due to uncaught exceptions triggered by malformed multipart requests received after an asynchronous operation. When req.file(), req.files(), or req.parts() is called following an async operation, parsing may begin prematurely, causing Busboy to emit an error before user error handlers are attached, which crashes the Node.js process. The fix adds an immediate error listener to file streams to catch and handle these early errors safely.
Who does this affect?
You are affected if you are using a vulnerable version of the package.
Background info
@fastify/multipart is vulnerable to Denial of Service (DoS) in versions 6.0.0 - 9.2.1.
How to fix this
Upgrade the @fastify/multipart library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant