CVE-2026-74866 · GHSA-gxm5-99cw-xjw9

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Risk score: 45/100
CVSS: 5.8 v3.1
Exploit chance (30 days): 0.3%
Published: 5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is carried verbatim into the filena…
Affected: @fastify/busboy (npm) < 3.2.2
Fix: Upgrade @fastify/busboy to 3.2.2 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@fastify/busboy: Amber, patch this week. Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array(256). A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted re…

The flaws

CVE-2026-74866: @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name (CVSS 5.8 · EPSS 0%)
CVE-2026-19484: @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary (CVSS 7.5 · EPSS 1%)
CVE-2026-19481: @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header (CVSS 7.5 · EPSS 0%)

The fix

Upgrade @fastify/busboy: 3.2.1 or later on your release line

Who is exposed: @fastify/busboy (npm) >= 3.1.0, < 3.2.1

Where it stands

No known exploitation

Connects to

Same weakness: CWE-93 (CWE-93). 20 other warnings in 30 days

Why it is Yellow

CVSS 5.8 medium
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@fastify/busboy	npm	< 3.2.2	3.2.2

References

Original description

### Impact `@fastify/busboy` 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed `Content-Disposition` parameters returned to the application. The multipart header parser ends a header line only on the two-byte `\r\n` sequence, so a lone CR or LF embedded in a part header is carried verbatim into the `filename` and field `name` delivered by the `file` and `field` events. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character. An attacker who uploads a file whose `filename` or field `name` contains a bare CR or LF can pollute filenames on disk when the upload is saved under its original name, inject forged lines into logs, or inject headers on a downstream hop that does not re-validate CR/LF, such as object-storage metadata or a proxied backend. Applications using `@fastify/busboy` directly, or through `@fastify/multipart` and its consumers, are affected. ### Patches Upgrade to `@fastify/busboy` 3.2.2 or later. ### Workarounds Validate or strip carriage return and line feed characters from the `filename` and field `name` before using them in any filesystem, logging, or outbound-header context.

Last activity 5 Oct 2026. Patch Forecast updates every hour.