CVE-2026-74866

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

EUVD-2026-63829

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-74866

@fastify/busboy (a multipart form-data parser for Node.js) is vulnerable to CRLF injection via the Content-Disposition filename and field name. The part-header parser splits lines only on the two-byte CRLF sequence, so a lone carriage return or line feed embedded in a part header is carried verba...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-19508

A heap-based buffer overflow in jst_post.c (multipart form-data parser) in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to send a crafted multipart/form-data request, causing memory corruption, denial of service, and potentially arbitrary code execut...

EUVD-2026-62718

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19481

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...

CVE-2026-19484

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

EUVD-2026-57757

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...

CVE-2026-19481 @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...

CVE-2026-19481 @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...

CVE-2026-19481

Summary: CVE-2026-19481 affects the multipart-form data parser in the @fastify/busboy package (versions 1.0.0–3.2.0). An attacker can submit multipart data with a part header named after a prototype-inherited property (e.g., proto , constructor), causing the header parser (which stores headers in...

CVE-2026-18246

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

CVE-2026-18246

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

CVE-2026-18246

CVE-2026-18246 affects IBM i 7.3–7.6, classified as CWE-436 (Interpretation Conflict) in the multipart parser of Navigator for i, allowing authenticated remote attackers to bypass security restrictions (CVSS 3.0 LOW). IBM has released PTFs SJ10887 (7.6), SJ10888 (7.5), SJ10890 (7.4), and SJ10891 ...

EUVD-2026-57351

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

CVE-2026-18246 IBM i is Affected By security restrictions bypass in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

PT-2026-71167

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

Linux Distros Unpatched Vulnerability : CVE-2026-45705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart...