CVE-2026-19481: @fastify/busboy Denial of Service via Prototype-Named Multipart Part Header

Background

The @fastify/busboy package is a popular middleware for handling multipart/form-data in Node.js applications. It allows developers to easily parse incoming form data, particularly file uploads. This package is widely used due to its efficiency and integration with the Fastify framework. However, certain versions of this package are vulnerable to a Denial of Service (DoS) attack, which can be exploited by unauthenticated clients submitting malicious multipart data.

Vulnerability Detail

The vulnerability arises from the way the multipart header parser in @fastify/busboy stores part-header names on a plain JavaScript object. If a part header is named 'proto' or 'constructor', it resolves to an inherited value that is not an array. This leads to a TypeError when the parser attempts to call the push method on a non-function, resulting in a crash of the Node.js process if the error is uncaught. This vulnerability affects all versions from 1.0.0 up to, but not including, 3.2.1, allowing unauthenticated clients to exploit it through multipart/form-data submissions.

npm install @fastify/busboy@3.2.4

npm install @fastify/busboy@3.2.1

Workaround

As a temporary workaround, you can attach an error listener to the Busboy stream to handle parser failures gracefully. Here is an example of how to implement this:

const busboy = require('@fastify/busboy');

const bb = busboy({ headers: req.headers });

bb.on('error', (err) => {
  console.error('Busboy error:', err);
  // Handle the error appropriately
});

req.pipe(bb);

Additionally, wrap any direct write() or end() calls in a try/catch block to prevent crashes:

try {

  bb.write(data);
} catch (error) {
  console.error('Error writing to Busboy:', error);
}

Conclusion

In summary, the @fastify/busboy package has a critical vulnerability that can lead to Denial of Service attacks if not addressed. Upgrading to version 3.2.1 or later is essential to mitigate this risk. Implementing the suggested workarounds can provide temporary relief while you prepare for the upgrade.

See every vulnerability recorded for @fastify/busboy →

FAQ