10 matches found
CVE-2026-19474
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...
CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...
CVE-2026-19474
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...
PT-2026-73034
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...
CVE-2025-24033
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the saveRequestFiles function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use...
@andesite-lab/andesite-core (>=1.60.2, <=1.62.0), @dzangolab/fastify-s3 (0.80.0) +6 more potentially affected by CVE-2025-24033 via @fastify/multipart (>=9.0.0, <=9.0.2)
@fastify/multipart NPM version =9.0.0, =1.60.2, =0.4.15, =1.0.36, =1.91.0, =5.0.0-beta.36, =0.15.0, =0.1.10, =0.1.15 Source cves: CVE-2025-24033 Source advisory: OSV:GHSA-27C6-MCXV-X3FH...
@fibus-digital/sluby (>=0.4.0, <=0.4.14), @hexancore/core (>=0.15.0, <=0.16.0) +6 more potentially affected by CVE-2025-24033 via @fastify/multipart (>=8.0.0, <=8.3.0)
@fastify/multipart NPM version =8.0.0, =0.4.0, =0.15.0, =8.0.0-canary.1293, =8.0.0-canary.1293, =8.0.0-canary.1293, =0.0.1, =4.50.7-test.1, =0.0.1, =0.14.0 Source cves: CVE-2025-24033 Source advisory: OSV:GHSA-27C6-MCXV-X3FH...
CVE-2025-24033
creationtimestamp| type| source ---|---|--- 2025-01-23 17:42:08+00:00| seen| https://infosec.exchange/users/cve/statuses/113878900944416033 2025-01-23 18:03:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/2780 2025-01-23 18:16:11+00:00| seen|...
CVE-2025-24033 @fastify/multipart vulnerable to unlimited consumption of resources
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the saveRequestFiles function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use...
CVE-2025-24033 @fastify/multipart vulnerable to unlimited consumption of resources
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the saveRequestFiles function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use...