CVE-2020-8136

CVE-2020-8136 affects fastify-multipart via a prototype-pollution path in versions below 1.0.5, enabling an attacker to crash Fastify applications during multipart request parsing with a crafted input. Connected advisories (GHSA-QH73-QC3P-RJV2 and RH/CVE entries) confirm a bypass vector involving...

CVE-2021-23597

CVE-2021-23597 affects the npm package fastify-multipart prior to 5.3.1. By supplying a name=constructor property, an attacker can crash the application, bypassing the prior CVE-2020-8136 fix. Several sources (OSV, GHSA advisories, CNNVD) confirm the vulnerability and identify upgrading to v5.3.1...

CVE-2023-25576

CVE-2023-25576 affects the Fastify multipart plugin (@fastify/multipart). The vulnerability is a denial-of-service caused by the multipart body parser accepting an unlimited number of parts (files, fields, or empty field parts). It is fixed by upgrading to v7.4.1 for Fastify v4.x and v6.0.1 for F...

CVE-2026-19474

The CVE-2026-19474 entry concerns @fastify/multipart, affecting versions 3.0.0 up to but not including 10.1.1. The root cause is that request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts; the iterato...

CVE-2026-18549

The CVE-2026-18549 issue affects @fastify/multipart versions 5.3.0 through 10.1.0. When the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the stream remains open. If the client aborts before the terminating boundary is sent, abort cleanup...