Executive brief
@fastify/multipart is a file upload parser for the Fastify web framework. When a file upload exceeds the configured size limit and a client aborts the connection, the plugin fails to properly clean up temporary files and request handlers become permanently suspended. An unauthenticated attacker can repeatedly trigger this to exhaust disk space and exhaust the application's worker capacity, causing a complete denial of service.
Technical details
This is a resource exhaustion vulnerability in the fileSize limit handling code path. When busboy truncates a file part due to exceeding the fileSize limit, the plugin clears its internal current-file reference while the underlying stream remains open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream reference to destroy, causing saveRequestFiles() to never settle and the request handler to hang indefinitely. Simultaneously, the temporary file written to disk is never deleted. An unauthenticated network attacker can repeat this attack cheaply to leak temporary files and suspend handler executions, exhausting both disk space and event-loop capacity. The vulnerability affects versions 5.3.0 through 10.1.0 and is fixed in 10.1.1.
Affected products
- OpenJS Foundation @fastify/multipart 5.3.0 to 10.1.0
Timeline
- 2026-08-14: disclosed
- 2026-08-15: patched: Fixed in version 10.1.1