Executive brief
@fastify/busboy is a multipart form-data parser used by web applications to process file uploads and form submissions. An unauthenticated attacker can send a single crafted multipart request with a specially sized boundary to stall the Node.js event loop, consuming one CPU core and denying service to other requests handled by the same application process.
Technical details
The vulnerability is a CPU-bound infinite loop (CWE-835) triggered by a multipart boundary of exactly 252 bytes. The streaming search algorithm stores its skip table in a fixed 256-entry Uint8Array; a 252-byte boundary creates a 256-byte search needle whose skip distance entry wraps to zero, causing the search to loop indefinitely without progressing. The vulnerability requires no authentication and is triggered by a network-reachable multipart request. An attacker can stall one CPU core per request, degrading availability for other users. The issue is patched in version 3.2.1, which widens the skip table to preserve skip distance. RFC 2046 recommends boundaries not exceed 70 characters; workarounds include validating boundary length at a reverse proxy or via an onRequest hook.
Affected products
- Fastify busboy 3.1.0 through 3.2.0
Timeline
- 2026-08-13: disclosed: Published in security advisory
- 2026-08-13: patched: Fixed in version 3.2.1