GHSA-gxm5-99cw-xjw9

Suggest an improvement
Source
https://github.com/advisories/GHSA-gxm5-99cw-xjw9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gxm5-99cw-xjw9/GHSA-gxm5-99cw-xjw9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gxm5-99cw-xjw9
Aliases
Published
2026-10-05T22:33:44Z
Modified
2026-10-05T22:45:04Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
Details

Impact

@fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is carried verbatim into the filename and field name delivered by the file and field events. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character.

An attacker who uploads a file whose filename or field name contains a bare CR or LF can pollute filenames on disk when the upload is saved under its original name, inject forged lines into logs, or inject headers on a downstream hop that does not re-validate CR/LF, such as object-storage metadata or a proxied backend. Applications using @fastify/busboy directly, or through @fastify/multipart and its consumers, are affected.

Patches

Upgrade to @fastify/busboy 3.2.2 or later.

Workarounds

Validate or strip carriage return and line feed characters from the filename and field name before using them in any filesystem, logging, or outbound-header context.

Database specific 
{
    "cwe_ids":  [
        "CWE-93"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-05T22:33:44Z",
    "nvd_published_at":  "2026-08-21T09:16:40Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / @fastify/busboy

Package

Name
@fastify/busboy
View open source insights on deps.dev
Purl
pkg:npm/%40fastify/busboy

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gxm5-99cw-xjw9/GHSA-gxm5-99cw-xjw9.json"