CVE-2026-19481: @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.
Other sources
Impact
Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parser throws TypeError: this.header[h].push is not a function. Through the documented req.pipe(busboy) integration this surfaces as an error event, while direct write()/end() usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected.
Patches
Fixed in version 3.2.1.
Workarounds
Attach an error listener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap direct write()/end() calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@fastify/busboyto a version that resolves this vulnerability.Fixed in 3.2.1 - Upgrade
Upgrade
@fastify/busboyto a version that resolves this vulnerability.Fixed in 3.2.1 - Compensating control
Attach an error listener to the Busboy stream, and wrap direct write() and end() calls in try/catch so parser failures are handled without crashing the Node.js process.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19481?
CVE-2026-19481 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-19481?
To fix CVE-2026-19481, upgrade @fastify/busboy to version 3.2.1 or later.
What types of attacks does CVE-2026-19481 enable?
CVE-2026-19481 enables Denial of Service attacks by crashing the multipart form-data parser.
Which versions of @fastify/busboy are affected by CVE-2026-19481?
CVE-2026-19481 affects @fastify/busboy versions from 1.0.0 through 3.2.0.
What kind of data can an attacker submit to exploit CVE-2026-19481?
An attacker can exploit CVE-2026-19481 by submitting multipart form-data with part headers named after prototype-inherited properties like __proto__ or constructor.