Executive brief
Fastify Multipart is a Node.js library that handles file uploads and form submissions in Fastify web applications. An attacker can send HTTP requests with an unlimited number of file parts, field parts, or empty parts, causing the server to consume excessive memory and CPU, resulting in a denial of service that makes the application unavailable to legitimate users.
Technical details
The vulnerability exists in the multipart body parser implementation, which fails to enforce limits on the number of parts (files, fields, or empty parts) accepted in a single multipart/form-data request. This is a resource exhaustion vulnerability (CWE-400, CWE-770) exploitable over the network without authentication or user interaction. An attacker can craft a malicious multipart request with an unbounded number of parts to trigger excessive memory allocation and processing, causing denial of service. The vulnerability was fixed in versions 6.0.1 (for Fastify v3.x) and 7.4.1 (for Fastify v4.x).
Affected products
- Fastify Multipart <=6.0.0; 7.0.0-7.4.0
Timeline
- 2023-02-14: disclosed
- 2023-02-14: patched: v6.0.1 for Fastify v3.x and v7.4.1 for Fastify v4.x