CVE-2023-25576: @fastify/multipart vulnerable to DoS due to unlimited number of parts
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-25576?
@fastify/multipart is a Fastify plugin that may experience denial of service due to accepting an unlimited number of parts in the multipart body parser.
Which software versions are affected by CVE-2023-25576?
Versions up to 6.0.1 and versions between 7.0.0 and 7.4.1 of Fastify Fastify-multipart are affected.
What is the severity of CVE-2023-25576?
The severity of CVE-2023-25576 is high with a score of 7.5.
How can I fix CVE-2023-25576?
Update Fastify-multipart plugin to version 7.4.1 or newer.
Where can I find more information about CVE-2023-25576?
You can find more information about CVE-2023-25576 at the following references: [GitHub Commit](https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297), [Fastify-multipart v6.0.1 Release](https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1), [Fastify-multipart v7.4.1 Release](https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1).