[ Vendor · 3 CVEs ]
@fastify/busboy
CVEs affecting @fastify/busboy published in the last 30 days, plus any @fastify/busboy CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-74866 | 21 Aug 2026 | CVSS 5.8 | @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte… | Fix |
| CVE-2026-19484 | 13 Aug 2026 | CVSS 7.5 | @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop… | Fix |
| CVE-2026-19481 | 13 Aug 2026 | CVSS 7.5 | @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser… | Fix |