{"id":"CVE-2026-19481","aliases":["CLSA-2026-1792746654","EUVD-2026-57757","GHSA-x8mw-p69m-v3mx","ROOT-APP-NPM-CVE-2026-19481"],"status":"published","title":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00493,"percentile":0.42647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2026-08-13T08:31:25Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"npm","package":"@fastify/busboy","fixed_in":["3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@fastify/busboy","fixed_in":["2.1.1-aikido.2","3.2.0-aikido.2","1.2.1-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fastify__busboy","fixed_in":["2.1.1-root.io.2","3.2.0-root.io.2","1.2.1-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@fastify/busboy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@fastify/busboy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-tuxcare.0"},{"fixed":"2.1.1-tuxcare.1"}]}],"versions":["2.1.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"@fastify/busboy","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@fastify/busboy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-aikido.2"},{"fixed":"3.2.0-aikido.2"},{"fixed":"1.2.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fastify__busboy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-root.io.2"},{"fixed":"3.2.0-root.io.2"},{"fixed":"1.2.1-root.io.2"}]}]}],"products":[{"vendor":"@fastify/busboy","product":"@fastify/busboy"},{"vendor":"fastify","product":"fastify\\/busyboy"}],"references":[{"url":"https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx","tags":["Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19481","tags":["advisory"]},{"url":"https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b","tags":["web"]},{"url":"https://github.com/fastify/busboy/releases/tag/v3.2.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x8mw-p69m-v3mx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19481.json","tags":["advisory"]},{"url":"https://github.com/fastify/busboy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-19481","title":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","status":"published","published":"2026-08-13T08:31:25.413Z","modified":"2026-08-13T14:25:29.262Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-57757","description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","status":"published","published":"2026-08-13T08:31:25Z","modified":"2026-08-13T14:25:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-x8mw-p69m-v3mx","title":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","description":"### Impact\n\nVersions of `@fastify/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named `__proto__` or `constructor` resolves to an inherited value that is not an array, and the parser throws `TypeError: this.header[h].push is not a function`. Through the documented `req.pipe(busboy)` integration this surfaces as an `error` event, while direct `write()`/`end()` usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected.\n\n### Patches\n\nFixed in version 3.2.1.\n\n### Workarounds\n\nAttach an `error` listener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap direct `write()`/`end()` calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.","status":"published","published":"2026-10-02T23:16:36Z","modified":"2026-10-02T23:17:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-19481","description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","status":"published","published":"2026-08-13T09:17:12.573Z","modified":"2026-09-03T19:16:01.753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-19481","title":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","status":"published","published":"2026-08-13T08:31:25.413Z","modified":"2026-10-28T02:30:43.189616758Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"GHSA-x8mw-p69m-v3mx","title":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","description":"### Impact\n\nVersions of `@fastify/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named `__proto__` or `constructor` resolves to an inherited value that is not an array, and the parser throws `TypeError: this.header[h].push is not a function`. Through the documented `req.pipe(busboy)` integration this surfaces as an `error` event, while direct `write()`/`end()` usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected.\n\n### Patches\n\nFixed in version 3.2.1.\n\n### Workarounds\n\nAttach an `error` listener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap direct `write()`/`end()` calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.","status":"published","published":"2026-10-02T23:16:36Z","modified":"2026-10-02T23:30:05.651087437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"CLSA-2026-1792746654","title":"TuxCare security update for @fastify/busboy (2 CVEs)","description":"TuxCare rebuilt @fastify/busboy to address 2 CVEs. Fixed in 2.1.1-tuxcare.1.","status":"published","published":"2026-10-23T09:10:54Z","modified":"2026-10-23T13:45:35.083688752Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"ROOT-APP-NPM-CVE-2026-19481","title":"CVE-2026-19481 in @fastify/busboy - Patched by Root","description":"Root has patched CVE-2026-19481 in the @fastify/busboy package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T11:39:19Z","modified":"2026-10-19T12:15:03.599347612Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}