# CVE-2026-66730: facil.io infinite loop in multipart body parser

Source: https://junglewise.ai/threats/cve-2026-66730-facil-io-infinite-loop-in-multipart-body-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-66730 · Severity: high · CVSS 7.5 · Published 2026-07-27

facil.io is a high-performance web application framework. A flaw in how it handles web form uploads allows an unauthenticated attacker to send a specially crafted request that causes the server's processor to spin in an infinite loop. This effectively freezes the server, making it unresponsive to legitimate users and requiring a manual restart to restore service.

Technologies: [Boaz Segev Facil.Io](https://junglewise.ai/threats/technologies/facil-io). Vendors: [Boaz Segev](https://junglewise.ai/threats/vendors/boaz-segev).

## Quick answers

**Is CVE-2026-66730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66730 being exploited in the wild.

**How severe is CVE-2026-66730?** High severity, with a CVSS score of 7.5, published 27 July 2026.

**Which products and versions are affected?** Boaz Segev Facil.Io 0.6.0 through 0.7.6.

**Is there a fix for CVE-2026-66730?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66730 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66730?** Check whether you run Boaz Segev Facil.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in the multipart/form-data parser of facil.io versions 0.6.0 through 0.7.6. The root cause is a missing progress guard in the `http_parse_body` loop within `lib/facil/http/http.c`. When a request contains a partial closing boundary, the `http_mime_parse` function returns zero bytes consumed without setting the 'done' or 'error' flags. This causes the calling loop to indefinitely re-invoke the parser on the same data buffer, leading to an infinite loop (CWE-835) that consumes 100% CPU. An unauthenticated remote attacker can exhaust all available worker processes with a single request, necessitating a manual restart of the server.

## Affected products

- boazsegev facil.io 0.6.0 through 0.7.6

## Timeline

- 2026-07-27: disclosed: Vulnerability disclosed by researcher Theodosis Paidakis
- 2026-07-27: advisory

## References

- [https://github.com/theopaid/Infinite-Loop-DoS-in-facil.io-MIME-Parser](https://github.com/theopaid/Infinite-Loop-DoS-in-facil.io-MIME-Parser)
- [https://www.vulncheck.com/advisories/facil-io-infinite-loop-dos-via-multipart-mime-body-parser](https://www.vulncheck.com/advisories/facil-io-infinite-loop-dos-via-multipart-mime-body-parser)

## Related threats

- [facil.io denial of service in HTTP/1.1 chunked transfer encoding parser](https://junglewise.ai/threats/cve-2026-66731-facil-io-denial-of-service-in-http-1-1-chunked-transfer-encoding)
- [facil.io integer underflow in multipart MIME body parser](https://junglewise.ai/threats/cve-2026-66729-facil-io-integer-underflow-in-multipart-mime-body-parser)
- [boazsegev facil.io path traversal in Public Folder Handler](https://junglewise.ai/threats/cve-2026-16653-boazsegev-facil-io-path-traversal-in-public-folder-handler)
- [boazsegev facil.io improper input validation in WebSocket Frame Parser](https://junglewise.ai/threats/cve-2026-16632-boazsegev-facil-io-improper-input-validation-in-websocket-frame)
- [facil.io and iodine infinite loop in JSON parser](https://junglewise.ai/threats/cve-2026-41146-facil-io-and-iodine-infinite-loop-in-json-parser)