Description

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T10:17:11.640Z",
  "pubdate": "2026-08-13T10:17:11.640Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in the multipart form-data parser @fastify/busboy versions 3.1.0 through 3.2.0, allowing a remote unauthenticated attacker to stall the Node.js event loop.\nThe vulnerability is caused by a flawed boundary length calculation in the vendored streaming search skip table, which truncates the default skip distance to zero when processing a boundary of exactly 252 bytes.\nThis behavior transforms the search operation into an infinite CPU-bound loop processing a small request body, fully consuming a single CPU core and denying service to concurrent requests handled by the same single-threaded Node.js process.\nThe attack requires no authentication or special privileges and can be triggered remotely via a single crafted HTTP multipart request.\nThe risk implications are significant for availability, as malicious payloads can easily degrade or halt application responsiveness in production environments without requiring high bandwidth or complex exploit chains.\nImpacted systems include any deployment utilizing the vulnerable @fastify/busboy package versions 3.1.0 to 3.2.0 for handling multipart data.",
  "technicalDetails": "The root cause of the vulnerability resides in the vendored streaming search implementation used by @fastify/busboy to parse incoming multipart form-data streams.\nThis streaming search mechanism stores its skip table in a fixed 256-entry byte array, a design limitation that becomes critical when calculating search needle offsets.\nSpecifically, when a remote attacker transmits a multipart request whose boundary is crafted to a specific length of exactly 252 bytes, the resulting search needle length expands to 256 bytes.\nThis exact length condition forces an integer truncation or overflow condition that sets the default skip distance in the skip table to zero.\nWith a skip distance of zero, the Boyer-Moore-style or similar substring search algorithm fails to advance its pointer through the input stream, causing the search loop to repeatedly evaluate the exact same byte offset indefinitely.\nThe step-by-step attack flow begins with an unauthenticated remote attacker dispatching an HTTP multipart request containing the maliciously crafted 252-byte boundary over the network.\nUpon receipt, the vulnerable component processes the request body through the parsing engine.\nThe parsing engine initializes the vendored streaming search against the payload, encounters the 256-byte search needle representation, and applies the zeroed skip table.\nThe execution thread enters the infinite CPU-bound loop on the small body, locking the single-threaded Node.js event loop.\nBecause Node.js relies on an asynchronous, non-blocking event-driven architecture, locking the main thread with a synchronous CPU-bound loop halts all pending and incoming asynchronous operations, resulting in a complete denial of service for the affected process.\nThe vulnerability affects @fastify/busboy versions 3.1.0 through 3.2.0, with no authentication or user interaction required for exploitation over network exposure points."
}