CVE-2026-74866: @fastify/busboy CRLF Injection Vulnerability
Summary
CVE-2026-74866: @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name. Affects @fastify/busboy versions < 3.2.2. Fixed in 3.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fastify/busboy package is a popular library used for handling multipart form data in Node.js applications. It allows developers to easily parse incoming files and fields from HTTP requests. However, versions 3.2.1 and earlier are vulnerable to a critical issue where carriage return (CR) or line feed (LF) characters can be retained in the parsed Content-Disposition parameters, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the way @fastify/busboy processes multipart headers. Specifically, it does not adequately handle bare CR or LF characters within the Content-Disposition parameters. As a result, these control characters can be included in the filename or field name returned to the application. This can lead to various security issues, such as file system pollution, log injection, or header injection in downstream services that do not validate CR/LF characters. Attackers can exploit this vulnerability by uploading files with malicious filenames or field names containing CR or LF characters.
How To Fix
Latest published version: 3.2.4 as of 22 Oct 2026
npm install @fastify/busboy@3.2.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.2
This is the first release that contains the fix.
npm install @fastify/busboy@3.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can validate or strip carriage return and line feed characters from the filename and field name before using them in any filesystem, logging, or outbound-header context. Here is an example of how to do this in JavaScript:
const sanitizeInput = (input) => {
return input.replace(/\r/g, '').replace(/\n/g, '');
};
const safeFilename = sanitizeInput(uploadedFilename);
const safeFieldName = sanitizeInput(uploadedFieldName);
Conclusion
The @fastify/busboy package has a vulnerability that allows for CRLF injection through improperly handled multipart headers. It is crucial to upgrade to version 3.2.2 or later to mitigate this risk. Additionally, implementing input sanitization can serve as a temporary workaround while ensuring your application remains secure.
See every vulnerability recorded for @fastify/busboy →
FAQ
CRLF injection is a type of attack where an attacker inserts carriage return (CR) and line feed (LF) characters into input fields, potentially allowing them to manipulate how data is processed or displayed.
If you are using @fastify/busboy version 3.2.1 or earlier, your application is vulnerable. You can also use the Vulert playground to check for vulnerabilities without any signup.
Consequences include file system pollution, log injection, and header injection, which can lead to data breaches or application misbehavior.
Yes, you can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities.
The CVSS score for this vulnerability is 5.8, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fastify/busboy.
