@fastify/busboy vulnerabilities

@fastify/busboy is a multipart form-data parser for Node.js. Its part-header parser splits lines only on CRLF, so a lone CR or LF in a header is not treated as a line break and is passed verbatim to the filename and field name. An attacker can inject control characters, leading to filesystem filename pollution, log forging, or header injection. Versions up to 3.2.1 are affected; fixed in 3.2.2.

@fastify/busboy versions 3.1.0 through 3.2.0 are vulnerable to a DoS attack that stalls the Node.js event loop by sending a multipart request with a boundary of a specific length. A single small request can keep one core busy and deny service to other requests. The issue is fixed in version 3.2.1.

@fastify/busboy versions 1.0.0 through 3.2.0 are vulnerable to a parser crash by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. This can trigger a TypeError and potentially terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in version 3.2.1.