Resource exhaustion in Fastify Fastify-Multipart
CVE-2023-25576
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.015 (72.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 72.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Fastify Fastify-Multipart — versions < 6.0.1, >= 7.0.0, < 7.4.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g (Third Party Advisory)
- github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173… (Patch, Third Party Advisory)
- hackerone.com/reports/1816195 (Permissions Required, Third Party Advisory)
- github.com/fastify/fastify-multipart/releases/tag/v6.0.1 (Third Party Advisory, Release Notes)
- github.com/fastify/fastify-multipart/releases/tag/v7.4.1 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2023-25576?
- CVE-2023-25576 is a high-severity vulnerability in Fastify Fastify-Multipart, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2023-02-14.
- How severe is CVE-2023-25576?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-25576 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.