{"id":"CVE-2026-19484","state":"PUBLISHED","title":"@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary","description":"@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.","publishedAt":"2026-08-13T08:50:47.361Z","updatedAt":"2026-08-13T14:27:01.128Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"openjs"},"assigner":"openjs","products":["@fastify/busboy @fastify/busboy"],"affected":[{"vendor":"@fastify/busboy","product":"@fastify/busboy","packageURL":"pkg:npm/@fastify/busboy","defaultStatus":"unaffected","versions":[{"version":"3.1.0","status":"affected","lessThan":"3.2.1","versionType":"semver"},{"version":"3.2.1","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw","https://cna.openjsf.org/security-advisories.html"],"weaknesses":["CWE-835","CWE-1322"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19484.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19484","state":"PUBLISHED","datePublished":"2026-08-13T08:50:47.361Z","dateUpdated":"2026-08-13T14:27:01.128Z","assignerShortName":"openjs","assignerOrgId":"ce714d77-add3-4f53-aff5-83d477b104bb","dateReserved":"2026-08-10T16:17:07.041Z"},"containers":{"cna":{"title":"@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary","descriptions":[{"lang":"en","value":"@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1."}],"affected":[{"vendor":"@fastify/busboy","product":"@fastify/busboy","packageURL":"pkg:npm/@fastify/busboy","defaultStatus":"unaffected","versions":[{"version":"3.1.0","status":"affected","lessThan":"3.2.1","versionType":"semver"},{"version":"3.2.1","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw"},{"url":"https://cna.openjsf.org/security-advisories.html"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-835","lang":"en","description":"CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1322","lang":"en","description":"CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context","type":"CWE"}]}],"providerMetadata":{"shortName":"openjs","orgId":"ce714d77-add3-4f53-aff5-83d477b104bb","dateUpdated":"2026-08-13T08:50:47.361Z"},"credits":[{"lang":"en","type":"reporter","value":"LorenzoRD2003"},{"lang":"en","type":"remediation developer","value":"mcollina"},{"lang":"en","type":"remediation reviewer","value":"UlisesGascon"}],"x_generator":{"engine":"cve-kit 1.0.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-13T14:26:38.443138Z","id":"CVE-2026-19484","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-13T14:27:01.128Z"}}]}}}