CVE-2026-66731

facil.io prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0 has an infinite loop vulnerability in `fio_json_parse` when encountering a nested JSON value starting with 'i' or 'I'. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, it is also affected.

A denial-of-service vulnerability in facil.io 0.6.0 through 0.7.6 in the multipart body parser allows unauthenticated remote attackers to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary, exhausting all workers and disabling the server until manual restart.

facil.io versions 0.6.0 through 0.7.6 contain an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.

A path traversal vulnerability exists in boazsegev facil.io up to version 0.7.58 in the http_sendfile2 function of the Public Folder Handler component. Remote exploitation is possible and the exploit has been released.

In the facil.io library up to version 0.7.4, a vulnerability was found in the websocket_on_protocol_error function in websocket_parser.h. Manipulation of the on_message argument leads to improper input validation, which can be exploited remotely. The project has not responded to the issue report.