@fastify/multipart vulnerabilities
We track 2 vulnerabilities in @fastify/multipart products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 15, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest @fastify/multipart vulnerabilities
- 7.5 High severity
@fastify/multipart: Incomplete Cleanup
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multip
- 7.5 High severity
@fastify/multipart: Uncontrolled Resource Consumption
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is st