Junglewise Threat Intelligence

CVE-2023-25576: Fastify Multipart denial of service due to unlimited parts

CVE-2023-25576 · Severity: low · CVSS 3.1 · Published 2023-02-14

Technologies: Fastify Multipart. Vendors: Fastify.

Executive brief

Fastify Multipart is a Node.js library that handles file uploads and form submissions in Fastify web applications. An attacker can send HTTP requests with an unlimited number of file parts, field parts, or empty parts, causing the server to consume excessive memory and CPU, resulting in a denial of service that makes the application unavailable to legitimate users.

Technical details

The vulnerability exists in the multipart body parser implementation, which fails to enforce limits on the number of parts (files, fields, or empty parts) accepted in a single multipart/form-data request. This is a resource exhaustion vulnerability (CWE-400, CWE-770) exploitable over the network without authentication or user interaction. An attacker can craft a malicious multipart request with an unbounded number of parts to trigger excessive memory allocation and processing, causing denial of service. The vulnerability was fixed in versions 6.0.1 (for Fastify v3.x) and 7.4.1 (for Fastify v4.x).

Affected products

  • Fastify Multipart <=6.0.0; 7.0.0-7.4.0

Timeline

  • 2023-02-14: disclosed
  • 2023-02-14: patched: v6.0.1 for Fastify v3.x and v7.4.1 for Fastify v4.x

References

Related threats