CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-19474

The CVE-2026-19474 entry concerns @fastify/multipart, affecting versions 3.0.0 up to but not including 10.1.1. The root cause is that request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts; the iterato...

MINI-49GX-65VV-M985

Bulletin has no description...

MINI-C289-GQ9G-J7PP

Bulletin has no description...

MINI-F2RH-RPHP-35JH

Bulletin has no description...

MINI-P7R2-5P42-MG69

Bulletin has no description...

MINI-Q72M-9XWQ-672F

Bulletin has no description...

MINI-7VRC-5FWF-8Q6H

Bulletin has no description...

MINI-GP88-WF7P-MMXC

Bulletin has no description...

MINI-3GJW-C44F-H2QX

Bulletin has no description...

MINI-89RF-RQV2-G5VM

Bulletin has no description...

MINI-W3H9-WG56-927V

Bulletin has no description...

MINI-CMPC-PHP9-Q626

Bulletin has no description...

MINI-RCP7-VPGP-G3XP

Bulletin has no description...

MINI-8JCX-CR8R-5WQH

Bulletin has no description...

MINI-C7GR-4JCQ-6444

Bulletin has no description...

CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

EUVD-2026-59759

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...