@fastify/busboy vulnerabilities
We track 2 vulnerabilities in @fastify/busboy products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest @fastify/busboy vulnerabilities
- 7.5 High severity
@fastify/busboy: Loop with Unreachable Exit Condition
@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search st
- 7.5 High severity
@fastify/busboy: Improper Check for Unusual or Exceptional Conditions
@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The in