Executive brief
A vulnerability in the @fastify/multipart library, which handles file uploads for Fastify web applications, can lead to server storage exhaustion. When a user starts an upload but cancels the request before it finishes, the system fails to delete the partially uploaded temporary files. An attacker could exploit this by repeatedly starting and canceling large uploads to fill up the server's disk space, potentially causing the application or the entire server to crash.
Technical details
A resource management vulnerability (CWE-770) exists in the `saveRequestFiles` function of the @fastify/multipart library. The root cause is a failure to implement cleanup logic for temporary files when a client aborts a multipart/form-data request. An unauthenticated remote attacker can exploit this by initiating multiple large file uploads and terminating the connections prematurely. This results in the accumulation of orphaned temporary files on the server's disk, eventually leading to a denial-of-service (DoS) condition due to storage exhaustion. The issue is resolved in versions 8.3.1 and 9.0.3.
Affected products
- Fastify @fastify/multipart <= 8.3.0, >= 9.0.0 < 9.0.3
Timeline
- 2024-09-25: disclosed: Issue first reported on GitHub
- 2025-01-23: patched: Fix merged and versions 8.3.1/9.0.3 released
- 2025-01-23: advisory: GitHub Security Advisory published