CLSA-2026-1792746654 TuxCare security update for @fastify/busboy (2 CVEs)

TuxCare rebuilt @fastify/busboy to address 2 CVEs. Fixed in 2.1.1-tuxcare.1...

PT-2026-135390

TuxCare rebuilt @fastify/busboy to address 2 CVEs. Fixed in 2.1.1-tuxcare.1...

ROOT-APP-NPM-AIKIDO-2026-87401 AIKIDO-2026-87401 in @fastify/busboy - Patched by Root

Root has patched AIKIDO-2026-87401 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-19481 CVE-2026-19481 in @fastify/busboy - Patched by Root

Root has patched CVE-2026-19481 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-19484 CVE-2026-19484 in @fastify/busboy - Patched by Root

Root has patched CVE-2026-19484 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-961622 AIKIDO-2026-961622 in @fastify/busboy - Patched by Root

Root has patched AIKIDO-2026-961622 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

PT-2026-117139

Root has patched AIKIDO-2026-87401 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

GHSA-GXM5-99CW-XJW9 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

EUVD-2026-63829

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.7-ruixiang.1) +15 more potentially affected by CVE-2026-74866 via @fastify/busboy (>=3.0.0, <=3.2.1)

@fastify/busboy NPM version =3.0.0, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =5.4.5, =3.31.25, =0.0.1, =7.2.29, =9.10.0-1, =0.27.0, =0.28.0 and more Source cves: CVE-2026-74866 Source advisory: GHSA-GXM5-99CW-XJW9...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.7-ruixiang.1) +15 more potentially affected by CVE-2026-74866 via @fastify/busboy (>=3.0.0, <=3.2.1)

@fastify/busboy NPM version =3.0.0, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =5.4.5, =3.31.25, =0.0.1, =7.2.29, =9.10.0-1, =0.27.0, =0.28.0 and more Source cves: CVE-2026-74866 Source advisory: OSV:GHSA-GXM5-99CW-XJW9...

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

EUVD-2026-57757

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header...

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14035 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)

@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: GHSA-X8MW-P69M-V3MX...

0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14035 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)

@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: OSV:GHSA-X8MW-P69M-V3MX...

GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.7-ruixiang.1) +14 more potentially affected by CVE-2026-19484 via @fastify/busboy (>=3.1.1, <=3.2.0)

@fastify/busboy NPM version =3.1.1, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =6.1.1, =3.31.25, =9.2.8-0, =9.10.0-1, =0.27.0, =4.0.0, =4.2.0 and more Source cves: CVE-2026-19484 Source advisory: GHSA-XJH9-V7X6-24JW...

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...