Is CVE-2026-117531 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117531 being exploited in the wild.

How severe is CVE-2026-117531?

Medium severity, with a CVSS score of 5.9, published 2 November 2026.

Which products and versions are affected?

Fastify @Fastify/Multipart 5.3.0 through 10.1.6.

Is there a fix for CVE-2026-117531?

Yes: fixed in @fastify/multipart 10.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-117531 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-117531?

Check whether you run Fastify @Fastify/Multipart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117531: @fastify/multipart denial of service via malformed upload

CVE-2026-117531 · Severity: medium · CVSS 5.9 · Published 2026-11-02

@fastify/multipart is a plugin for the Fastify web framework that handles file uploads. When a client sends a malformed upload request with an incomplete file boundary, the plugin destroys the file stream without reporting an error, causing request handlers waiting for the file to hang indefinitely. An attacker can send repeated malformed uploads to exhaust server resources and cause a denial of service.

Technologies: Fastify @Fastify/Multipart. Vendors: Fastify.

Quick answers

Is CVE-2026-117531 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117531 being exploited in the wild.
How severe is CVE-2026-117531?: Medium severity, with a CVSS score of 5.9, published 2 November 2026.
Which products and versions are affected?: Fastify @Fastify/Multipart 5.3.0 through 10.1.6.
Is there a fix for CVE-2026-117531?: Yes: fixed in @fastify/multipart 10.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-117531 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-117531?: Check whether you run Fastify @Fastify/Multipart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: @fastify/multipart 10.1.7

Technical details

The vulnerability exists in versions 5.3.0 through 10.1.6 where parser errors are not propagated to the file stream when a request body ends inside a file part with no closing boundary. A handler performing asynchronous work before consuming the file attaches to a stream that never emits an error or end event, leaving connections open indefinitely. An unauthenticated remote attacker can exploit this via network by sending malformed multipart requests to a route using delayed file consumers.

Affected products

fastify @fastify/multipart 5.3.0 through 10.1.6

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.