GHSA-xjh9-v7x6-24jw: High severity npm/@fastify/busboy vulnerability
Impact
Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array(256). A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted request keeps the search in a CPU-bound loop and stalls the Node.js event loop. An unauthenticated client can trigger this with a single small request. Applications that use @fastify/busboy to parse multipart/form-data, directly or through @fastify/multipart, are affected.
Patches
Fixed in version 3.2.1.
Workarounds
Validate the multipart boundary before parsing and reject any boundary longer than the RFC 2046 limit of 70 characters (for example at a reverse proxy or in an onRequest hook). Upgrading to 3.2.1 removes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@fastify/busboyto a version that resolves this vulnerability.Fixed in 3.2.1 - Upgrade
Upgrade
@fastify/busboyto a version that resolves this vulnerability.Fixed in 3.2.1 - Compensating control
Validate the multipart boundary before parsing and reject any boundary longer than 70 characters, for example at a reverse proxy or in an onRequest hook.
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service issue?
Applications are affected if they use @fastify/busboy to parse multipart/form-data, either directly or through @fastify/multipart. A remotely reachable multipart upload endpoint using an affected version is exposed.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker can send a single small multipart request with a boundary crafted to be exactly 252 bytes, causing CPU-bound processing that stalls the Node.js event loop.
Which versions are affected and what version fixes the issue?
Versions from 3.1.0 up to, but not including, 3.2.1 are vulnerable. The issue is fixed in @fastify/busboy 3.2.1.
What can be done if upgrading is not immediately possible?
Validate multipart boundaries before they reach the parser and reject boundaries longer than the RFC 2046 limit of 70 characters. This can be enforced at a reverse proxy or in an onRequest hook.