Read the docs
TI-2026-15865 Aliases CVE-2026-19481GHSA-x8mw-p69m-v3mx

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Priority LOW 39CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Fix Partial @fastify/busboy (@fastify/busboy): 3.2.1@fastify/busboy (npm): 3.2.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/busboy1.0.0 to before 3.2.13.2.1Patch availableCNA
—@fastify/busboy (npm)1.0.0 to before 3.2.13.2.1Patch availableGHSA-x8mw-p69m-v3mx
  • @fastify/busboy Vendorfastify Affected 1.0.0 to before 3.2.1 Fixed in 3.2.1 Patch available CNA
  • @fastify/busboy (npm) Vendor— Affected 1.0.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-x8mw-p69m-v3mx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify\/busyboy:*:*:*:*:*:node.js:*:*1.0.0 to before 3.2.1Vulnerablefastify
  • cpe:2.3:a:fastify:fastify\/busyboy:*:*:*:*:*:node.js:*:* Versions 1.0.0 to before 3.2.1 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/busboy (@fastify/busboy) Fixed in 3.2.1
  • Fix · GHSA-x8mw-p69m-v3mx @fastify/busboy (npm) Fixed in 3.2.1 Advisory →

Red Hat 2 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    @fastify/busboy 3.2.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-15867 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundaryPriority MEDIUM 40
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift PipelinesAffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Not affected: 4 products
  • Red Hat AMQ Broker 7
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19481
  2. 2026-10-03 Alias added: GHSA-x8mw-p69m-v3mx
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  6. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat

References

Advisory 3

Other 3

  • TI-2026-15867 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary CVSS 3.1HIGH 7.5
  • TI-2026-52585 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences