TI-2020-06554 Aliases CVE-2020-8136 GHSA-p9f8-gqjf-m75j

Uncontrolled resource consumption in fastify-multipart

LOW 36CWE-400Published 2020-03-20 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.

Why it matters now

EPSS 0.01497 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed fastify-multipart (npm): 1.0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	fastify-multipart	Fixed version: 1.0.5	—	No fix listed	CNA
—	fastify-multipart (npm)	before 1.0.5	1.0.5	Patch available	GHSA-p9f8-gqjf-m75j

fastify-multipart Vendor— Affected Fixed version: 1.0.5 Fixed in — No fix listed CNA
fastify-multipart (npm) Vendor— Affected before 1.0.5 Fixed in 1.0.5 Patch available GHSA-p9f8-gqjf-m75j

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fastify:fastify-multipart::::::fastify::*	before 1.0.5	Vulnerable	fastify

cpe:2.3:a:fastify:fastify-multipart:*:*:*:*:*:fastify:*:* Versions before 1.0.5 Vulnerable ·fastify

Remediation

Fix · GHSA-p9f8-gqjf-m75j fastify-multipart (npm) Fixed in 1.0.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-8136
2026-10-03 Alias added: GHSA-p9f8-gqjf-m75j

References

Exploit 1

https://hackerone.com/reports/804772

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-8136

TI-2023-10879 @fastify/multipart vulnerable to DoS due to unlimited number of parts CVSS 3.1HIGH 7.5
TI-2026-15210 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit CVSS 3.1HIGH 7.5
TI-2026-15859 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload CVSS 3.1HIGH 7.5
TI-2021-06170 Denial of service (DoS) in fastify-multipart CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences