Description

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-21T09:16:40.890Z",
  "pubdate": "2026-08-21T09:16:40.890Z",
  "executiveSummary": "A control character injection vulnerability exists in @fastify/busboy, a multipart form-data parser for Node.js, affecting all versions up to and including 3.2.1.\nThe vulnerability arises because the multipart part-header parser exclusively splits header lines on the two-byte carriage-return line-feed sequence, failing to properly sanitize lone carriage returns or line feeds embedded within part headers.\nConsequently, these unhandled control characters are carried verbatim into the parsed Content-Disposition filename and field name parameters passed to downstream consumer applications.\nAn unauthenticated remote attacker can exploit this behavior by crafting malicious file upload requests containing bare carriage returns or line feeds within the filename or field name headers.\nSuccessful exploitation enables downstream injection attacks when consumer applications blindly trust the parser to return sanitized values, leading to severe risk implications such as filesystem filename pollution, log forging, and HTTP header injection when forwarded to sensitive sinks.\nAffected systems include any Node.js applications and framework integrations, such as @fastify/multipart, that utilize vulnerable versions of @fastify/busboy to handle multipart form-data inputs.",
  "technicalDetails": "The root cause of the vulnerability resides in the multipart part-header parsing logic of the vulnerable component, specifically within @fastify/busboy versions up to and including 3.2.1.\nThe parser evaluates incoming multipart headers by searching exclusively for the standard two-byte carriage-return line-feed (CRLF) sequence to demarcate individual header lines.\nWhen a multipart payload contains a lone carriage return (CR) or a lone line feed (LF) within a part header—such as inside the Content-Disposition header's filename or field name parameters—the parser does not recognize it as a valid line break.\nInstead of rejecting the malformed header or stripping the unauthorized control characters, the parser preserves them verbatim and includes them in the output objects returned to the consuming Node.js application.\nThe attack flow begins when an attacker crafts a multipart/form-data HTTP request containing a specially formulated payload within the file upload filename or form field name parameters.\nUpon receiving the upload request, the vulnerable @fastify/busboy parser processes the multipart stream and extracts the unsanitized filename or field name containing the bare control characters.\nThe parser then hands these tainted strings directly to the consuming application.\nIf the consumer application trusts these values and forwards them to a carriage-return-sensitive sink without additional validation or sanitization, the injected control characters alter the intended semantic structure of the data.\nThis behavior facilitates various post-exploitation impacts depending on the downstream sink, including filesystem filename pollution where files are written to unintended paths or with malformed names, log forging where attackers manipulate log entries to spoof events or inject fake records, and HTTP header injection if the values are reflected in downstream protocol headers.\nNo authentication or elevated privileges are required to supply multipart form-data inputs to the network-exposed parser, making remote exploitation straightforward against vulnerable services."
}