CVE-2025-24033: Fastify @fastify/multipart resource exhaustion in saveRequestFiles

CVE-2025-24033 · Severity: low · CVSS 3.1 · Published 2025-01-23

A vulnerability in the @fastify/multipart library, which handles file uploads for Fastify web applications, can lead to server storage exhaustion. When a user starts an upload but cancels the request before it finishes, the system fails to delete the partially uploaded temporary files. An attacker could exploit this by repeatedly starting and canceling large uploads to fill up the server's disk space, potentially causing the application or the entire server to crash.

Technologies: Fastify Multipart. Vendors: Fastify.

Quick answers

Is CVE-2025-24033 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-24033 being exploited in the wild.
How severe is CVE-2025-24033?
Low severity, with a CVSS score of 3.1, published 23 January 2025.
Which products and versions are affected?
Fastify Multipart <= 8.3.0, >= 9.0.0 < 9.0.3.
Is there a fix for CVE-2025-24033?
A patch was published on 2025-01-23: Fix merged and versions 8.3.1/9.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24033 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-24033?
Check whether you run Fastify Multipart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource management vulnerability (CWE-770) exists in the `saveRequestFiles` function of the @fastify/multipart library. The root cause is a failure to implement cleanup logic for temporary files when a client aborts a multipart/form-data request. An unauthenticated remote attacker can exploit this by initiating multiple large file uploads and terminating the connections prematurely. This results in the accumulation of orphaned temporary files on the server's disk, eventually leading to a denial-of-service (DoS) condition due to storage exhaustion. The issue is resolved in versions 8.3.1 and 9.0.3.

Affected products

  • Fastify @fastify/multipart <= 8.3.0, >= 9.0.0 < 9.0.3

Identifiers

  • CVE-2025-24033
  • GHSA-27c6-mcxv-x3fh

Timeline

  • 2024-09-25: disclosed: Issue first reported on GitHub
  • 2025-01-23: patched: Fix merged and versions 8.3.1/9.0.3 released
  • 2025-01-23: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.