Fastify Fastify-Multipart
6 CVEs affecting Fastify Fastify-Multipart. Latest disclosed: 2026-08-15. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19474 | High | 7.5 | 2026-08-15 | @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave com… |
CVE-2026-18549 | High | 7.5 | 2026-08-15 | @fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates… |
CVE-2025-24033 | High | 7.5 | 2025-01-23 | @fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not dele… |
CVE-2023-25576 | High | 7.5 | 2023-02-14 | @fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of serv… |
CVE-2021-23597 | High | 7.5 | 2022-02-11 | This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This… |
CVE-2020-8136 | High | 7.5 | 2020-03-20 | Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a special… |