AIKIDO-2026-87401
@fastify/busboy is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
@fastify/busboyTL;DR
The multipart header parser stores part-header names on a plain JavaScript object that inherits from Object.prototype. A part header named __proto__ or constructor resolves to an inherited non-array value, so the parser throws a TypeError when it tries to append the header value. Through the piped integration this surfaces as an error event, but direct write or end usage throws synchronously and can terminate the Node.js process, letting an unauthenticated client deny service. The fix builds the header map with a null prototype so inherited property names no longer collide.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted multipart/form-data with @fastify/busboy.
Background info
@fastify/busboy is vulnerable to Denial of Service (DoS) in versions 1.0.0 - 3.2.0.
How to fix this
Upgrade the @fastify/busboy library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant