CVE-2026-19481 · GHSA-x8mw-p69m-v3mx

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Risk score: 63/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.5%
Published: 2 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named __proto__ or constructor resolves to an inherited value that is not an array, and the parser throws TypeError: this.…
Affected: @fastify/busboy (npm) >= 1.0.0, < 3.2.1
Fix: Upgrade @fastify/busboy to 3.2.1 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@fastify/busboy: Amber, patch this week. Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array(256). A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted re…

The flaws

CVE-2026-19481: @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header (CVSS 7.5 · EPSS 0%)
CVE-2026-19484: @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary (CVSS 7.5 · EPSS 1%)
CVE-2026-74866: @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name (CVSS 5.8 · EPSS 0%)

The fix

Upgrade @fastify/busboy: 3.2.1 or later on your release line

Who is exposed: @fastify/busboy (npm) >= 3.1.0, < 3.2.1

Where it stands

No known exploitation

Connects to

Same weakness: CWE-754 (CWE-754). 16 other warnings in 30 days

Why it is Amber

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@fastify/busboy	npm	>= 1.0.0, < 3.2.1	3.2.1

References

Original description

### Impact Versions of `@fastify/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named `__proto__` or `constructor` resolves to an inherited value that is not an array, and the parser throws `TypeError: this.header[h].push is not a function`. Through the documented `req.pipe(busboy)` integration this surfaces as an `error` event, while direct `write()`/`end()` usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected. ### Patches Fixed in version 3.2.1. ### Workarounds Attach an `error` listener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap direct `write()`/`end()` calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.

Last activity 2 Oct 2026. Patch Forecast updates every hour.