CVE-2026-66730
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A denial-of-service vulnerability in facil.io 0.6.0 through 0.7.6 in the multipart body parser allows unauthenticated remote attackers to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary, exhausting all workers and disabling the server until manual restart.
Risk Assessment
Attackers can permanently disable the server, causing complete service unavailability until manual intervention.
Recommendation
Update facil.io to version 0.7.7 or later, which includes a fix for this issue.
Other vulnerabilities in facil.io
See all- CVE-2026-41146High
facil.io prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0 has an infinite loop vulnerability in `fio_json_parse` when encountering a nested JSON value starting with 'i' or 'I'. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, it is also affected.
- CVE-2026-66731High
A denial-of-service vulnerability in facil.io 0.7.5 through 0.7.6 in the HTTP/1.1 chunked transfer encoding parser allows unauthenticated remote attackers to crash the server by sending a negative chunk size value, causing memory corruption and a fault.
- CVE-2026-66729High
facil.io versions 0.6.0 through 0.7.6 contain an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.
- CVE-2026-16653Medium
A path traversal vulnerability exists in boazsegev facil.io up to version 0.7.58 in the http_sendfile2 function of the Public Folder Handler component. Remote exploitation is possible and the exploit has been released.
- CVE-2026-16632High
In the facil.io library up to version 0.7.4, a vulnerability was found in the websocket_on_protocol_error function in websocket_parser.h. Manipulation of the on_message argument leads to improper input validation, which can be exploited remotely. The project has not responded to the issue report.
Original NVD description (English source)
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error flags, causing the calling loop to re-invoke the parser on the same buffer indefinitely, exhausting all workers and permanently disabling the server until manually restarted.