CyberRota Analysis
AI-GeneratedThe @fastify/multipart parser is vulnerable in versions 5.3.0 to 10.1.0, allowing unauthenticated clients to exploit a file upload process that fails to clean up temporary files when a connection is aborted. This can lead to disk space exhaustion and event-loop blocking due to hanging request handlers. Organizations using affected versions should prioritize upgrading to 10.1.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)