CVE-2026-19474 json
@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
published 2026-08-15 2 mo ago modified 2026-09-02 2 mo ago also EUVD-2026-59761
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.
Patch / fix
- @fastify/multipart @fastify/multipart 10.1.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- @fastify/multipart @fastify/multipart
Classification
References
-
github.com
/fastify/fastify-multipart/security/advisories/GHSA-62qx-hpj5-j6hc
mitigation, vendor-advisory
-
cna.openjsf.org
/security-advisories.html
third-party-advisory
Sources
- CVE List CVE-2026-19474
- NVD CVE-2026-19474
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.