# CVE-2026-19484: Fastify busboy denial of service via oversized multipart boundary

Source: https://junglewise.ai/threats/cve-2026-19484-fastify-busboy-denial-of-service-via-oversized-multipart-boundary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19484 · Severity: high · CVSS 7.5 · Published 2026-08-13

@fastify/busboy is a multipart form-data parser used by web applications to process file uploads and form submissions. An unauthenticated attacker can send a single crafted multipart request with a specially sized boundary to stall the Node.js event loop, consuming one CPU core and denying service to other requests handled by the same application process.

Technologies: [Fastify Busboy](https://junglewise.ai/threats/technologies/busboy), [@fastify/busboy (npm)](https://junglewise.ai/threats/technologies/npm-fastify-busboy). Vendors: [Fastify](https://junglewise.ai/threats/vendors/fastify), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-19484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19484 being exploited in the wild.

**How severe is CVE-2026-19484?** High severity, with a CVSS score of 7.5, published 13 August 2026.

**Which products and versions are affected?** Fastify Busboy 3.1.0 through 3.2.0; @fastify/busboy (npm) >= 3.1.0, < 3.2.1, SEMVER:introduced=3.1.0,fixed=3.2.1.

**Is there a fix for CVE-2026-19484?** Yes. @fastify/busboy (npm): upgrade to 3.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19484 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19484?** Check whether you run Fastify Busboy, Fastify Busyboy or @fastify/busboy (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @fastify/busboy (npm): upgrade to 3.2.1 or later

  ```sh
  npm install @fastify/busboy@3.2.1
  ```


## Technical details

The vulnerability is a CPU-bound infinite loop (CWE-835) triggered by a multipart boundary of exactly 252 bytes. The streaming search algorithm stores its skip table in a fixed 256-entry Uint8Array; a 252-byte boundary creates a 256-byte search needle whose skip distance entry wraps to zero, causing the search to loop indefinitely without progressing. The vulnerability requires no authentication and is triggered by a network-reachable multipart request. An attacker can stall one CPU core per request, degrading availability for other users. The issue is patched in version 3.2.1, which widens the skip table to preserve skip distance. RFC 2046 recommends boundaries not exceed 70 characters; workarounds include validating boundary length at a reverse proxy or via an onRequest hook.

## Affected products

- Fastify busboy 3.1.0 through 3.2.0

## Identifiers

- CVE-2026-19484
- GHSA-xjh9-v7x6-24jw

## Timeline

- 2026-08-13: disclosed: Published in security advisory
- 2026-08-13: patched: Fixed in version 3.2.1

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw](https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw)

## Related threats

- [@fastify/busboy denial of service via prototype-named multipart header](https://junglewise.ai/threats/cve-2026-19481-fastify-busboy-vulnerable-to-denial-of-service-via-prototype)
- [@fastify/busboy CRLF injection in multipart headers](https://junglewise.ai/threats/cve-2026-74866-fastify-busboy-crlf-injection-in-multipart-headers)