Is CVE-2023-25576 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-25576 being exploited in the wild.

How severe is CVE-2023-25576?

Low severity, with a CVSS score of 3.1, published 14 February 2023.

Which products and versions are affected?

Fastify Multipart <=6.0.0; 7.0.0-7.4.0.

Is there a fix for CVE-2023-25576?

A patch was published on 2023-02-14: v6.0.1 for Fastify v3.x and v7.4.1 for Fastify v4.x Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-25576 attacked?

It is attacked over the network.

Am I affected by CVE-2023-25576?

Check whether you run Fastify Multipart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-25576: Fastify Multipart denial of service due to unlimited parts

Q: Which products and versions are affected?

Fastify Multipart <=6.0.0; 7.0.0-7.4.0.

Q: Is there a fix for CVE-2023-25576?

A patch was published on 2023-02-14: v6.0.1 for Fastify v3.x and v7.4.1 for Fastify v4.x Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-25576 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2023-25576?

Check whether you run Fastify Multipart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-25576 · Severity: low · CVSS 3.1 · Published 2023-02-14

Fastify Multipart is a Node.js library that handles file uploads and form submissions in Fastify web applications. An attacker can send HTTP requests with an unlimited number of file parts, field parts, or empty parts, causing the server to consume excessive memory and CPU, resulting in a denial of service that makes the application unavailable to legitimate users.

Technologies: Fastify Multipart. Vendors: Fastify.

Quick answers

Is CVE-2023-25576 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-25576 being exploited in the wild.
How severe is CVE-2023-25576?: Low severity, with a CVSS score of 3.1, published 14 February 2023.
Which products and versions are affected?: Fastify Multipart <=6.0.0; 7.0.0-7.4.0.
Is there a fix for CVE-2023-25576?: A patch was published on 2023-02-14: v6.0.1 for Fastify v3.x and v7.4.1 for Fastify v4.x Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-25576 attacked?: It is attacked over the network.
Am I affected by CVE-2023-25576?: Check whether you run Fastify Multipart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the multipart body parser implementation, which fails to enforce limits on the number of parts (files, fields, or empty parts) accepted in a single multipart/form-data request. This is a resource exhaustion vulnerability (CWE-400, CWE-770) exploitable over the network without authentication or user interaction. An attacker can craft a malicious multipart request with an unbounded number of parts to trigger excessive memory allocation and processing, causing denial of service. The vulnerability was fixed in versions 6.0.1 (for Fastify v3.x) and 7.4.1 (for Fastify v4.x).

Affected products

Fastify Multipart <=6.0.0; 7.0.0-7.4.0

Identifiers

CVE-2023-25576
GHSA-hpp2-2cr5-pf6g

Timeline

2023-02-14: disclosed
2023-02-14: patched: v6.0.1 for Fastify v3.x and v7.4.1 for Fastify v4.x

References

https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.