← Vulnerability feed

Vulnerability record · CVE-2026-19474 · published 15 August 2026

CVE-2026-19474: Fastify-multipart allocation without limits vulnerability

Fastify · Fastify Multipart

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

7.5 CVSS 3.1 High EPSS 0.49% · top 60.1% CWE-459 · CWE-459CWE-770 · Allocation without limits
7.5CVSS 3.1 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
2 Sep 2026Last modified by NVD

Description

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.openjsf.org/security-advisories.html Third Party Advisory
https://github.com/fastify/fastify-multipart/security/advisories/GHSA-62qx-hpj5-j6hc MitigationVendor Advisory

Track CVE-2026-19474 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-18549Fastify-multipart uncontrolled resource consumption vulnerability@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit…EPSS 0.60%7.5CVE-2023-25576Fastify-multipart allocation without limits vulnerability@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience deni…EPSS 1.5%7.5CVE-2021-23597Fastify-multipart prototype pollution vulnerabilityThis affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **No…EPSS 2.0%7.5CVE-2020-8136Fastify-multipart uncontrolled resource consumption vulnerabilityPrototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2026-19474), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.