Repository navigation
fix(deps): update dependency @fastify/busboy to v3.2.2 [security] - #2167
Merged
Merged
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.2.0→3.2.2@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
CVE-2026-19481 / GHSA-x8mw-p69m-v3mx
More information
Details
Impact
Versions of
@fastify/busboyfrom 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named__proto__orconstructorresolves to an inherited value that is not an array, and the parser throwsTypeError: this.header[h].push is not a function. Through the documentedreq.pipe(busboy)integration this surfaces as anerrorevent, while directwrite()/end()usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected.Patches
Fixed in version 3.2.1.
Workarounds
Attach an
errorlistener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap directwrite()/end()calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
CVE-2026-19484 / GHSA-xjh9-v7x6-24jw
More information
Details
Impact
Versions of
@fastify/busboyfrom 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in aUint8Array(256). A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted request keeps the search in a CPU-bound loop and stalls the Node.js event loop. An unauthenticated client can trigger this with a single small request. Applications that use@fastify/busboyto parse multipart/form-data, directly or through@fastify/multipart, are affected.Patches
Fixed in version 3.2.1.
Workarounds
Validate the multipart boundary before parsing and reject any boundary longer than the RFC 2046 limit of 70 characters (for example at a reverse proxy or in an onRequest hook). Upgrading to 3.2.1 removes the issue.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
CVE-2026-74866 / GHSA-gxm5-99cw-xjw9
More information
Details
Impact
@fastify/busboy3.2.1 and earlier retains a bare carriage return or line feed inside the parsedContent-Dispositionparameters returned to the application. The multipart header parser ends a header line only on the two-byte\r\nsequence, so a lone CR or LF embedded in a part header is carried verbatim into thefilenameand fieldnamedelivered by thefileandfieldevents. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character.An attacker who uploads a file whose
filenameor fieldnamecontains a bare CR or LF can pollute filenames on disk when the upload is saved under its original name, inject forged lines into logs, or inject headers on a downstream hop that does not re-validate CR/LF, such as object-storage metadata or a proxied backend. Applications using@fastify/busboydirectly, or through@fastify/multipartand its consumers, are affected.Patches
Upgrade to
@fastify/busboy3.2.2 or later.Workarounds
Validate or strip carriage return and line feed characters from the
filenameand fieldnamebefore using them in any filesystem, logging, or outbound-header context.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
fastify/busboy (@fastify/busboy)
v3.2.2Compare Source
Fix for GHSA-gxm5-99cw-xjw9
v3.2.1: - Security releaseCompare Source
This is a security release for
@fastify/busboy.It addresses the following security advisories:
Users should upgrade to v3.2.1.
Full Changelog: fastify/busboy@v3.2.0...v3.2.1
Configuration
📅 Schedule: (UTC)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.