CVE-2025-24033: @fastify/multipart vulnerable to unlimited consumption of resources
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the saveRequestFiles function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use saveRequestFiles.
Other sources
Impact
The saveRequestFiles function does not delete the uploaded temporary files when user cancels the request.
Patches
Fixed in version 8.3.1 and 9.0.3
Workarounds
Do not use saveRequestFiles.
References
This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24033?
CVE-2025-24033 is classified as a moderate severity vulnerability due to the potential for data leakage from unremoved temporary files.
How do I fix CVE-2025-24033?
To fix CVE-2025-24033, you should upgrade the @fastify/multipart package to version 9.0.3 or 8.3.1.
What problem does CVE-2025-24033 cause?
CVE-2025-24033 occurs because the saveRequestFiles function does not delete uploaded temporary files when a user cancels a request.
Which versions of @fastify/multipart are affected by CVE-2025-24033?
Versions of @fastify/multipart prior to 8.3.1 and 9.0.3 are affected by CVE-2025-24033.
Is there a workaround for CVE-2025-24033?
While the ideal solution is to upgrade, implementing manual cleanup of temporary files can serve as a workaround for CVE-2025-24033.