Description

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T09:17:12.573Z",
  "pubdate": "2026-08-13T09:17:12.573Z",
  "executiveSummary": "A denial of service vulnerability exists in @fastify/busboy versions 1.0.0 through 3.2.0, involving the parsing of multipart form-data headers.\nThe vulnerability arises when an unauthenticated attacker submits a multipart form-data payload containing part headers with prototype-inherited property names, such as __proto__ or constructor.\nThis behavior triggers a TypeError within the internal header parser due to an incorrect assumption regarding data types stored in plain JavaScript objects.\nDepending on the integration pattern, the exception either surfaces as an unhandled error event or is thrown synchronously, terminating the Node.js process and causing a denial of service.\nNo special privileges or authentication are required to exploit this vulnerability, as any user capable of submitting multipart form-data to the application can trigger the crash.",
  "technicalDetails": "The root cause of the vulnerability resides in the internal header parser component of @fastify/busboy, which stores parsed headers within a plain JavaScript object without nullifying its prototype chain.\nThe affected component assumes that every stored header property resolves to an array data type during internal parsing and manipulation operations.\nWhen an attacker supplies a part header whose name collides with a prototype-inherited property—such as __proto__, constructor, or prototype—the property lookup resolves to a truthy, non-array value inherited from Object.prototype instead of undefined or an array.\nDuring execution, the parser attempts to perform array-specific operations on this non-array value, immediately triggering a uncaught TypeError.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious multipart form-data payload containing a part header with a prototype-inherited name like __proto__. 2) The attacker transmits this payload to the target application utilizing a vulnerable version of @fastify/busboy (1.0.0 through 3.2.0). 3) The parser processes the incoming stream and attempts to store and manipulate the malicious header within the plain JavaScript object. 4) The prototype pollution collision occurs, returning a non-array constructor or function object instead of an array. 5) The execution flow encounters a TypeError when processing the unexpected data type.\nIn direct write or end usage integration patterns, this exception is thrown synchronously and cannot be caught locally by standard stream error handlers, resulting in the abrupt termination of the entire Node.js process.\nIn common pipe integration scenarios, the failure manifests as an error event, which may still cause application instability or denial of service if unhandled.\nAffected versions include @fastify/busboy 1.0.0 through 3.2.0 across all network exposures where multipart form-data ingestion is enabled."
}