CVE-2026-74866
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
@fastify/busboy is a multipart form-data parser for Node.js. Its part-header parser splits lines only on CRLF, so a lone CR or LF in a header is not treated as a line break and is passed verbatim to the filename and field name. An attacker can inject control characters, leading to filesystem filename pollution, log forging, or header injection. Versions up to 3.2.1 are affected; fixed in 3.2.2.
Risk Assessment
Risk of injecting control characters into processing systems, potentially leading to file manipulation, log forging, or HTTP header injection.
Recommendation
Upgrade @fastify/busboy to version 3.2.2 or later, and update dependencies in @fastify/multipart.
Other vulnerabilities in @fastify/busboy
See all- CVE-2026-19484High
@fastify/busboy versions 3.1.0 through 3.2.0 are vulnerable to a DoS attack that stalls the Node.js event loop by sending a multipart request with a boundary of a specific length. A single small request can keep one core busy and deny service to other requests. The issue is fixed in version 3.2.1.
- CVE-2026-19481High
@fastify/busboy versions 1.0.0 through 3.2.0 are vulnerable to a parser crash by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. This can trigger a TypeError and potentially terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in version 3.2.1.
Original NVD description (English source)
@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.