ROOT-APP-NPM-CVE-2026-19481 CVE-2026-19481 in @fastify/busboy - Patched by Root

Root has patched CVE-2026-19481 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-87401 AIKIDO-2026-87401 in @fastify/busboy - Patched by Root

Root has patched AIKIDO-2026-87401 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-961622 AIKIDO-2026-961622 in @fastify/busboy - Patched by Root

Root has patched AIKIDO-2026-961622 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-19484 CVE-2026-19484 in @fastify/busboy - Patched by Root

Root has patched CVE-2026-19484 in the @fastify/busboy package for Root:npm. Multiple fixed versions available...

EUVD-2026-63829

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name...

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

GHSA-GXM5-99CW-XJW9 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +15 more potentially affected by CVE-2026-74866 via @fastify/busboy (>=3.0.0, <=3.2.1)

@fastify/busboy NPM version =3.0.0, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =5.4.5, =3.31.25, =0.0.1, =7.2.29, =9.10.0-1, =0.27.0, =0.28.0 and more Source cves: CVE-2026-74866 Source advisory: OSV:GHSA-GXM5-99CW-XJW9...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +15 more potentially affected by CVE-2026-74866 via @fastify/busboy (>=3.0.0, <=3.2.1)

@fastify/busboy NPM version =3.0.0, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =5.4.5, =3.31.25, =0.0.1, =7.2.29, =9.10.0-1, =0.27.0, =0.28.0 and more Source cves: CVE-2026-74866 Source advisory: GHSA-GXM5-99CW-XJW9...

GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14135 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)

@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: GHSA-X8MW-P69M-V3MX...

EUVD-2026-57757

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header...

0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14135 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)

@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: OSV:GHSA-X8MW-P69M-V3MX...

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +14 more potentially affected by CVE-2026-19484 via @fastify/busboy (>=3.1.1, <=3.2.0)

@fastify/busboy NPM version =3.1.1, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =6.1.1, =3.31.25, =9.2.8-0, =9.10.0-1, =0.27.0, =4.0.0, =4.2.0 and more Source cves: CVE-2026-19484 Source advisory: OSV:GHSA-XJH9-V7X6-24JW...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +14 more potentially affected by CVE-2026-19484 via @fastify/busboy (>=3.1.1, <=3.2.0)

@fastify/busboy NPM version =3.1.1, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =6.1.1, =3.31.25, =9.2.8-0, =9.10.0-1, =0.27.0, =4.0.0, =4.2.0 and more Source cves: CVE-2026-19484 Source advisory: GHSA-XJH9-V7X6-24JW...

EUVD-2026-57759

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary...

GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

CVE-2026-74866

A flaw was found in @fastify/busboy, a Node.js multipart form-data parser. The parser incorrectly handles lone carriage return or line feed characters in multipart part headers, treating them as part of the filename or field name rather than as line breaks. A remote attacker could exploit this by...