CVE-2026-18549

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18549
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18549.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18549
Aliases
  • GHSA-vmph-573x-85f6
Published
2026-08-15T13:26:53Z
Modified
2026-09-04T03:46:19Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
Details

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

Database specific 
{
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-400",
        "CWE-664"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18549.json"
}
References

Affected packages

Git / github.com/fastify/fastify-multipart

Affected ranges

Type
GIT
Repo
https://github.com/fastify/fastify-multipart
Events
Introduced
ddd75b67c135c1f344b3c2b8e9078460c98db88c
Fixed
6c4478afd699f8e8190e60fa8debccc6e7e5ed0c
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:fastify:fastify-multipart:*:*:*:*:*:fastify:*:*",
    "extracted_events": [
        {
            "introduced": "5.3.0"
        },
        {
            "fixed": "10.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v10.*
v10.0.0
v10.1.0
v5.*
v5.3.0
v5.3.1
v6.*
v6.0.0
v7.*
v7.0.0
v7.1.0
v7.1.1
v7.1.2
v7.2.0
v7.3.0
v7.4.0
v7.4.1
v7.4.2
v7.5.0
v7.6.0
v7.6.1
v7.7.0
v7.7.1
v7.7.2
v7.7.3
v8.*
v8.0.0
v8.1.0
v8.2.0
v8.3.0
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18549.json"