Description

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-15T14:17:07.710Z",
  "pubdate": "2026-08-15T14:17:07.710Z",
  "executiveSummary": "An incomplete-fix variant of CVE-2025-24033 affecting @fastify/multipart allows unauthenticated remote attackers to trigger persistent, linear disk consumption leading to a denial of service. The vulnerability stems from improper cleanup handling of completed temporary files when a client abruptly disconnects during multipart parsing. Specifically, when the parser advances between parts, an iterator rejection occurs outside the designated per-file cleanup path, causing previously completed temporary files to remain orphaned on disk indefinitely. This exposes the underlying host filesystem to resource exhaustion attacks without requiring authentication, specific privileges, or complex exploitation prerequisites. The vulnerability is addressed in version 10.1.1, and affected deployments are urged to upgrade immediately to prevent systemic storage depletion.",
  "technicalDetails": "The vulnerability resides within the request.saveRequestFiles() function and multipart parsing workflow of the @fastify/multipart library, specifically impacting versions 3.0.0 up to, but not including, 10.1.1. The root cause is an improper exception and lifecycle management flaw during the iteration over multipart form-data parts. When a client initiates a multipart file upload and subsequently disconnects while the parser is transitioning between individual parts, an asynchronous iterator rejection is triggered. Because this rejection event occurs outside the scope of the standard per-file cleanup logic, any temporary files that were successfully written to disk prior to the disconnection event are bypassed by the cleanup routine and are never unlinked.\nThe exploitation vector is network-based and accessible to unauthenticated attackers. An attacker can repeatedly issue specially crafted multipart requests containing file payloads and abruptly terminate the underlying TCP connection mid-stream during the parser's inter-part state advancement. This forces the asynchronous iterator to reject, successfully bypassing file deletion routines while leaving the generated temporary files persisted on the server filesystem. By automating and repeating this sequence, an adversary can continuously accumulate orphaned files, resulting in linear disk consumption. This post-exploitation impact degrades system stability, fills available storage partitions, and ultimately induces a denial of service affecting all applications utilizing the vulnerable Fastify server component."
}