fastify/fastify-multipart · Security
Unlimited consumption of resources in @fastify/multipart
- GHSA ID
- GHSA-27c6-mcxv-x3fh
- CVE ID
- CVE-2025-24033
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Impact
The saveRequestFiles function does not delete the uploaded temporary files when user cancels the request.
Patches
Fixed in version 8.3.1 and 9.0.3
Workarounds
Do not use saveRequestFiles.
References
This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.
CWEs
- CWE-770 · Allocation of Resources Without Limits or Throttling