# CVE-2026-117531: @fastify/multipart denial of service via malformed upload

Source: https://junglewise.ai/threats/cve-2026-117531-fastify-multipart-is-the-multipart-form-data-and-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-117531 · Severity: medium · CVSS 5.9 · Published 2026-11-02

@fastify/multipart is a plugin for the Fastify web framework that handles file uploads. When a client sends a malformed upload request with an incomplete file boundary, the plugin destroys the file stream without reporting an error, causing request handlers waiting for the file to hang indefinitely. An attacker can send repeated malformed uploads to exhaust server resources and cause a denial of service.

Technologies: [Fastify @Fastify/Multipart](https://junglewise.ai/threats/technologies/multipart). Vendors: [Fastify](https://junglewise.ai/threats/vendors/fastify).

## Quick answers

**Is CVE-2026-117531 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117531 being exploited in the wild.

**How severe is CVE-2026-117531?** Medium severity, with a CVSS score of 5.9, published 2 November 2026.

**Which products and versions are affected?** Fastify @Fastify/Multipart 5.3.0 through 10.1.6.

**Is there a fix for CVE-2026-117531?** Yes: fixed in @fastify/multipart 10.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117531 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-117531?** Check whether you run Fastify @Fastify/Multipart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in @fastify/multipart 10.1.7

## Technical details

The vulnerability exists in versions 5.3.0 through 10.1.6 where parser errors are not propagated to the file stream when a request body ends inside a file part with no closing boundary. A handler performing asynchronous work before consuming the file attaches to a stream that never emits an error or end event, leaving connections open indefinitely. An unauthenticated remote attacker can exploit this via network by sending malformed multipart requests to a route using delayed file consumers.

## Affected products

- fastify @fastify/multipart 5.3.0 through 10.1.6

## Timeline

- 2026-11-02: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fastify-multipart/security/advisories/GHSA-5849-5m6q-9632](https://github.com/fastify/fastify-multipart/security/advisories/GHSA-5849-5m6q-9632)