@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

CVE-2026-19481 affects @fastify/busboy versions >= 1.0.0 and < 3.2.1, the streaming multipart form-data parser used across the Node.js ecosystem — most notably as a transitive dependency of undici and, by extension, Node.js's built-in fetch(). The parser stores part-header names in a plain JavaScript object. When a crafted multipart request includes a header named __proto__ or constructor, the lookup resolves to an inherited prototype value (not an array), and the subsequent .push() call throws an unhandled TypeError. An unauthenticated remote attacker can crash any Node.js process that pipes incoming multipart/form-data through Busboy without an error handler.

The vendor's HIGH / 7.5 rating is defensible from a pure CVSS-vector standpoint — unauthenticated, network-reachable, low-complexity, high availability impact. But it overstates the real-world pain. The blast radius is a single Node.js worker process crash, not data loss or code execution. Production deployments behind PM2, systemd, or Kubernetes will auto-restart the process in under a second. Applications using the idiomatic req.pipe(busboy) pattern surface the error as an event rather than a hard crash. The fix (upgrade or add an error listener) is trivial. This is a nuisance DoS, not a service-killer.

Why this verdict

• DoS-only, no RCE or data impact. The worst outcome is a process crash — no confidentiality or integrity loss. CVSS correctly scores C:N/I:N, but a 7.5 label implies urgency disproportionate to the real consequence.
• Auto-restart neutralizes persistence. Production Node.js deployments use PM2, systemd, Kubernetes, or cluster mode. A crashed worker restarts in <1 second. The attacker must sustain a stream of requests to maintain degradation, which is indistinguishable from a volumetric DoS that your existing DDoS defenses already handle.
• Attack surface is narrower than the download count suggests. @fastify/busboy has ~20M weekly downloads because it's a transitive dep of undici/Node fetch, but the vulnerability only fires when the application *actually parses multipart/form-data through Busboy*. Pure JSON APIs, GraphQL services, and SSR apps are unaffected even if the package is in their node_modules.
• Trivial workaround available. Adding .on('error', handler) to the Busboy stream or wrapping in try/catch prevents the crash entirely, without upgrading.
• Role multiplier: @fastify/busboy is an application-layer npm library, not a canonical high-value-role component. (a) *Low-value role* (dev tooling, test harness): crash is irrelevant. (b) *Typical role* (line-of-business API server): crash restarts automatically, impact is seconds of downtime. (c) *High-value role* (CI/CD pipeline accepting artifact uploads, API gateway): even here the blast radius is a single worker process crash with auto-restart — it does not escalate to fleet compromise, identity takeover, or supply-chain pivot. No deployment role produces an outcome that triggers the HIGH floor.

Why not higher?

To warrant HIGH, the vulnerability would need to produce sustained, unrecoverable denial of service or affect a component where even brief downtime causes cascading failure (e.g., a domain controller, hypervisor, or PKI service). This bug crashes one worker process that auto-restarts in under a second. The attacker gains no foothold, no data, and no lateral movement capability. The attack is also fully mitigable by a one-line error handler without even upgrading the package.

Why not lower?

Despite the mitigations, this is still an unauthenticated, network-reachable crash with zero interaction required and trivial exploit complexity — a single curl command. The affected package has massive install-base reach, and not every deployment will have proper error handling or process supervision. For single-process Node.js deployments without restart logic (development servers promoted to production, serverless cold-start scenarios), the crash is real and disruptive. That practical exposure keeps it above LOW.

1. Add error handlers to all Busboy stream instances — Attach .on('error', (err) => { /* log and respond 400 */ }) to every Busboy instance in your codebase. This prevents the TypeError from becoming an uncaught exception. This is a code-level change deployable immediately as a compensating control; no package upgrade required.
2. Deploy WAF rule blocking __proto__ and constructor in multipart field names — Configure your WAF (AWS WAF, Cloudflare, ModSecurity) to reject multipart/form-data requests containing __proto__, constructor, or __defineGetter__ as field names. This blocks the attack at the network edge before it reaches the application. Deploy within the noisgate remediation window of 365 days, though sooner is better.
3. Ensure process supervision is configured — Verify that all Node.js services run under PM2, systemd, Kubernetes, or equivalent process manager with automatic restart on crash. This limits the blast radius of any uncaught exception to a sub-second restart.
4. Upgrade to @fastify/busboy >= 3.2.1 — The definitive fix. Run npm update @fastify/busboy or pin >=3.2.1 in your lockfile. For @fastify/multipart users, update to the latest version that pulls in the patched busboy. This is the remediation action under the noisgate 365-day remediation SLA for MEDIUM.

Run this on any host where a Node.js application using @fastify/busboy is deployed. Execute as the application user or any user with read access to the project's node_modules. Example: bash check_cve_2026_19481.sh /opt/myapp

#!/usr/bin/env bash
# CVE-2026-19481 checker for @fastify/busboy
# Usage: bash check_cve_2026_19481.sh /path/to/node/project
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
PKG_JSON="$PROJECT_DIR/node_modules/@fastify/busboy/package.json"

if [ ! -f "$PKG_JSON" ]; then
  echo "UNKNOWN — @fastify/busboy not found in $PROJECT_DIR/node_modules"
  exit 2
fi

VERSION=$(grep '"version"' "$PKG_JSON" | head -1 | sed 's/.*"version": *"\([^"]*\)".*/\1/')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse version from $PKG_JSON"
  exit 2
fi

# Compare version against fixed version 3.2.1
# Affected: >= 1.0.0, < 3.2.1
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3 | cut -d- -f1)

if [ "$MAJOR" -lt 1 ]; then
  echo "PATCHED — @fastify/busboy $VERSION is below affected range (< 1.0.0)"
  exit 0
elif [ "$MAJOR" -gt 3 ]; then
  echo "PATCHED — @fastify/busboy $VERSION is above fixed version"
  exit 0
elif [ "$MAJOR" -eq 3 ] && [ "$MINOR" -gt 2 ]; then
  echo "PATCHED — @fastify/busboy $VERSION is above fixed version"
  exit 0
elif [ "$MAJOR" -eq 3 ] && [ "$MINOR" -eq 2 ] && [ "$PATCH" -ge 1 ]; then
  echo "PATCHED — @fastify/busboy $VERSION (>= 3.2.1)"
  exit 0
else
  echo "VULNERABLE — @fastify/busboy $VERSION (CVE-2026-19481, fix in 3.2.1)"
  exit 1
fi

Sources

1. GitHub Security Advisory GHSA-x8mw-p69m-v3mx
2. @fastify/busboy GitHub Security Overview
3. @fastify/busboy npm package
4. Fastify Security Audit 2023-2024
5. @fastify/busboy Socket.dev Analysis
6. FIRST EPSS Scoring System
7. Fastify CVE List — CVEDetails