← Vulnerability feed

Vulnerability record · CVE-2023-25576 · published 14 February 2023

CVE-2023-25576: Fastify-multipart allocation without limits vulnerability

Fastify · Fastify Multipart

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.

7.5 CVSS 3.1 High EPSS 1.5% · top 27.4% CWE-770 · Allocation without limits
7.5CVSS 3.1 base score
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297 PatchThird Party Advisory
https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1 Release NotesThird Party Advisory
https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1 Release NotesThird Party Advisory
https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g Third Party Advisory
https://hackerone.com/reports/1816195 Permissions RequiredThird Party Advisory
https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297 PatchThird Party Advisory
https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1 Release NotesThird Party Advisory
https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1 Release NotesThird Party Advisory
https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g Third Party Advisory
https://hackerone.com/reports/1816195 Permissions RequiredThird Party Advisory

Track CVE-2023-25576 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-18549Fastify-multipart uncontrolled resource consumption vulnerability@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit…EPSS 0.60%7.5CVE-2026-19474Fastify-multipart allocation without limits vulnerability@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can…EPSS 0.49%7.5CVE-2021-23597Fastify-multipart prototype pollution vulnerabilityThis affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **No…EPSS 2.0%7.5CVE-2020-8136Fastify-multipart uncontrolled resource consumption vulnerabilityPrototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending…EPSS 1.5%8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2023-25576), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.