AIKIDO-2026-216729
@fastify/multipart is vulnerable to Denial of Service
75
High Risk
This Affects:
@fastify/multipartTL;DR
The multipart parser handles file uploads through saveRequestFiles() when a fileSize limit is configured. When an upload part exceeds that limit and the client aborts before sending the closing multipart boundary, the returned promise never resolves, so the request handler hangs without sending a response and the temporary file in the OS temp directory is never removed. Unauthenticated requests can repeat this cheaply to exhaust disk space and worker capacity. The fix moves stream destruction and cleanup into an outer error handler so aborted or truncated uploads release the stream and delete temporary files.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application calls request.saveRequestFiles() with a fileSize limit configured.
Background info
@fastify/multipart is vulnerable to Denial of Service in versions 5.3.0 - 10.1.0.
How to fix this
Upgrade the @fastify/multipart library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant