Fastify/busyboy vulnerabilities

2 known vulnerabilities in Fastify/busyboy from Fastify. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  @fastify/busboy: Loop with Unreachable Exit Condition

  CVE-2026-19484Aug 13, 2026@fastify/busboy

  @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search st

• 7.5 High severity

  @fastify/busboy: Improper Check for Unusual or Exceptional Conditions

  CVE-2026-19481Aug 13, 2026@fastify/busboy

  @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The in