Vulnerability record · CVE-2021-23597 · published 11 February 2022

CVE-2021-23597: Fastify-multipart prototype pollution vulnerability

Fastify · Fastify Multipart

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382).

7.5 CVSS 3.1 High EPSS 2.0% · top 19.7% CWE-1321 · Prototype pollution

7.5CVSS 3.1 base score, v2 5.0

2.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Fastify Multipart Fastify

References

Link	Tags
https://github.com/fastify/fastify-multipart/commit/a70dc7059a794589bd4fe066453141fc609e6066	PatchThird Party Advisory
https://github.com/fastify/fastify-multipart/releases/tag/v5.3.1	Release NotesThird Party Advisory
https://snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-2395480	ExploitPatchThird Party Advisory
https://github.com/fastify/fastify-multipart/commit/a70dc7059a794589bd4fe066453141fc609e6066	PatchThird Party Advisory
https://github.com/fastify/fastify-multipart/releases/tag/v5.3.1	Release NotesThird Party Advisory
https://snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-2395480	ExploitPatchThird Party Advisory

Track CVE-2021-23597 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-18549Fastify-multipart uncontrolled resource consumption vulnerability@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit…EPSS 0.60%15 Aug 2026 7.5CVE-2026-19474Fastify-multipart allocation without limits vulnerability@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can…EPSS 0.49%15 Aug 2026 7.5CVE-2023-25576Fastify-multipart allocation without limits vulnerability@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience deni…EPSS 1.5%14 Feb 2023 7.5CVE-2020-8136Fastify-multipart uncontrolled resource consumption vulnerabilityPrototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending…EPSS 1.5%20 Mar 2020 8.6CVE-2026-34621Adobe Acrobat Reader prototype pollution leads to code executionAdobe Acrobat and Reader (versions 24.001.30356, 26.001.21367 and earlier) are affected by prototype pollution (CWE-1321) that can result in arbitrar…KEVEPSS 2.2%analysed11 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2021-23597), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.