Executive brief
fastify-multipart is a Fastify plugin for handling multipart form uploads in Node.js applications. An attacker can crash the application by sending a specially crafted multipart request with a "constructor" property, bypassing a previous fix for prototype poisoning attacks. This causes a denial of service, making the web application unavailable to legitimate users.
Technical details
This vulnerability is a prototype poisoning bypass of CVE-2020-8136. The root cause is incomplete input validation in fastify-multipart's multipart form parser; the previous fix only blocked the __proto__ key but failed to check for other prototype chain accessors like "constructor". An unauthenticated attacker can send a crafted multipart request with name=constructor to trigger an uncaught exception that crashes the application. No authentication or user interaction is required, and the attack is network-accessible. The vulnerability is fixed in version 5.3.1 or later.
Affected products
- Fastify fastify-multipart < 5.3.1
Timeline
- 2022-02-11: disclosed
- 2022-02-11: patched: v5.3.1