1385 matches found
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...
CLSA-2026-1791052604 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.4...
CLSA-2026-1791050166 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.4...
CLSA-2026-1791028128 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.7.4-tuxcare.4...
PT-2026-113569
TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.4...
PT-2026-113563
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.4...
EUVD-2026-57757
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header...
GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...
0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14135 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)
@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: OSV:GHSA-X8MW-P69M-V3MX...
0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14135 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)
@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: GHSA-X8MW-P69M-V3MX...
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...
@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +14 more potentially affected by CVE-2026-19484 via @fastify/busboy (>=3.1.1, <=3.2.0)
@fastify/busboy NPM version =3.1.1, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =6.1.1, =3.31.25, =9.2.8-0, =9.10.0-1, =0.27.0, =4.0.0, =4.2.0 and more Source cves: CVE-2026-19484 Source advisory: OSV:GHSA-XJH9-V7X6-24JW...
@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +14 more potentially affected by CVE-2026-19484 via @fastify/busboy (>=3.1.1, <=3.2.0)
@fastify/busboy NPM version =3.1.1, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =6.1.1, =3.31.25, =9.2.8-0, =9.10.0-1, =0.27.0, =4.0.0, =4.2.0 and more Source cves: CVE-2026-19484 Source advisory: GHSA-XJH9-V7X6-24JW...
EUVD-2026-57759
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary...
GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...
CLSA-2026-1790966173 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.11.3-tuxcare.5...
CLSA-2026-1790937680 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.0-tuxcare.3...