CVE-2026-66729

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66729
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66729.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66729
Published
2026-07-27T16:52:34.776Z
Modified
2026-07-28T04:03:12.129077306Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
Details

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound in httpmime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66729.json",
    "cwe_ids": [
        "CWE-125"
    ]
}
References

Affected packages

Git / github.com/boazsegev/facil.io

Affected ranges

Type
GIT
Repo
https://github.com/boazsegev/facil.io
Events
Introduced
13472f2f025498828b0823705c863602bdb08b70
Last affected
512a354dbd31e1895647df852d1565f9d408ed91
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "last_affected": "0.7.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.6.0
0.6.0.beta
0.6.0.beta.2
0.6.0.beta.3
0.6.0.beta.4
0.6.0.beta.5
0.6.0.beta.6
0.6.0.beta.7
0.6.0.beta.8
0.6.0.dev
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.0.beta1
0.7.0.beta2
0.7.0.beta3
0.7.0.beta4
0.7.0.beta5
0.7.0.beta6
0.7.0.beta7
0.7.0.beta8
0.7.2
0.7.3
0.7.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66729.json"