@fastify/busboy is a multipart form-data parser.

CVE-2026-19484 is an infinite-loop denial-of-service in @fastify/busboy versions 3.1.0 through 3.2.0. The multipart boundary-search algorithm uses a lookup table internally. When an attacker sends a multipart request with a boundary of exactly 252 bytes, the search needle becomes 256 bytes, causing a table index to wrap to zero. This traps the parser in a CPU-bound loop on the Node.js event loop — a single malicious request is enough to hang the entire process. No authentication is required; the parser runs before any application middleware. Any service accepting multipart/form-data via @fastify/multipart, Fastify, or direct @fastify/busboy usage on the affected versions is vulnerable. The fix is in version 3.2.1, released August 12, 2026.

The vendor's HIGH / 7.5 rating is fair but slightly generous. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects unauthenticated network-reachable DoS. However, two factors temper real-world risk: (1) the affected version window is narrow — only two minor versions (3.1.0–3.2.0) are vulnerable, so a large portion of the ~22 million weekly download base still on 2.x or earlier 3.0.x is unaffected; and (2) the impact ceiling is availability loss, not code execution or data breach. We downgrade fractionally to 7.0 to reflect the constrained blast radius while respecting the trivial exploitability.

Why this verdict

• Unauthenticated, zero-click DoS — a single crafted HTTP request hangs the entire Node.js event loop. No credentials, no user interaction, no chaining required. This anchors the score at HIGH.
• Narrow affected version range — only 3.1.0 through 3.2.0 are vulnerable. The 2.x line and 3.0.x are unaffected, which materially reduces the exposed population from the ~22M weekly download figure. This is the primary downward pressure from the vendor's 7.5.
• Availability-only impact ceiling — there is no path from this bug to code execution, data exfiltration, or privilege escalation. The worst outcome is service downtime, which bounds the maximum severity.
• Role multiplier: @fastify/busboy is a userland npm library consumed by Node.js web applications. Typical deployment roles are API servers and web backends (role b). It does not run on domain controllers, hypervisors, identity providers, or kernel-mode agents. In a high-value role scenario (e.g., a Node.js API gateway fronting critical services), successful exploitation causes service unavailability — significant but not fleet compromise, domain takeover, or supply-chain pivot. The blast radius is host/service-level, not domain/fleet-level, so the floor remains HIGH (not CRITICAL).
• Trivial weaponization — the advisory description is essentially the PoC. Any attacker who can read the GHSA can reproduce it in under 5 minutes with curl. This prevents any downgrade below HIGH.

Why not higher?

This is not CRITICAL because the impact is limited to availability — there is no code execution, no data breach, no lateral movement. The affected component is a userland npm library, not a hypervisor, identity provider, or kernel-mode agent. The narrow version window (two minor releases) further limits the reachable population. DoS-only vulnerabilities, even trivially exploitable ones, do not meet the CRITICAL floor unless they affect safety-critical OT/ICS systems or enable cascading infrastructure failure.

Why not lower?

This cannot be MEDIUM because the exploitation is completely unauthenticated, requires zero user interaction, has trivial attack complexity, and the PoC is effectively public. A single small HTTP request can take down an entire Node.js process. The asymmetric cost (bytes in vs. full service hang) and the lack of any prerequisite compromise step mean there is no meaningful friction to justify a downgrade to MEDIUM.

1. Enforce RFC 2046 boundary length at the reverse proxy — RFC 2046 limits multipart boundaries to 70 characters. Configure your reverse proxy (nginx, HAProxy, Envoy, Cloudflare WAF) to reject requests with boundary= values exceeding 70 bytes. This neutralizes the attack vector entirely. Deploy within the noisgate HIGH mitigation SLA of 30 days, though given trivial exploitability, aim for days not weeks.
2. Upgrade @fastify/busboy to 3.2.1 — Drop-in fix with no breaking changes. Run npm update @fastify/busboy or pin ^3.2.1 in package.json. This is the definitive remediation. Target deployment within the noisgate HIGH remediation SLA of 180 days, but realistically push this in your next release cycle.
3. Run Node.js in cluster mode with health checks — Use node:cluster, PM2, or Kubernetes liveness probes with tight thresholds (e.g., 5-second event loop lag). This limits the blast radius of a single hung worker and auto-restarts affected processes. Not a fix — just damage containment.
4. Rate-limit multipart endpoints by source IP — Configure your WAF or API gateway to rate-limit POST requests to multipart-accepting endpoints. This raises the attacker's cost for sustained DoS but does not prevent single-request hangs.

Run this on any host with node and npm installed to check whether the installed @fastify/busboy version is in the vulnerable range. No special privileges required. Example: bash check_busboy_cve_2026_19484.sh /path/to/your/project

#!/usr/bin/env bash
# check_busboy_cve_2026_19484.sh
# Checks whether @fastify/busboy is in the vulnerable range 3.1.0–3.2.0
# Usage: bash check_busboy_cve_2026_19484.sh [project_dir]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"

if [ ! -d "$PROJECT_DIR/node_modules" ]; then
  echo "UNKNOWN — no node_modules found in $PROJECT_DIR. Run npm install first."
  exit 2
fi

PKG_JSON="$PROJECT_DIR/node_modules/@fastify/busboy/package.json"

if [ ! -f "$PKG_JSON" ]; then
  echo "UNKNOWN — @fastify/busboy not found in $PROJECT_DIR/node_modules."
  exit 2
fi

VERSION=$(node -e "console.log(require('$PKG_JSON').version)" 2>/dev/null)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not read version from $PKG_JSON."
  exit 2
fi

# Parse semver
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Vulnerable: >=3.1.0, <3.2.1
if [ "$MAJOR" -eq 3 ]; then
  if [ "$MINOR" -eq 1 ]; then
    echo "VULNERABLE — @fastify/busboy $VERSION is in the affected range (3.1.0–3.2.0). Upgrade to 3.2.1."
    exit 1
  elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -eq 0 ]; then
    echo "VULNERABLE — @fastify/busboy $VERSION is in the affected range (3.1.0–3.2.0). Upgrade to 3.2.1."
    exit 1
  fi
fi

echo "PATCHED — @fastify/busboy $VERSION is not in the vulnerable range."
exit 0

Sources

1. GHSA-xjh9-v7x6-24jw — @fastify/busboy DoS via oversized boundary
2. @fastify/busboy v3.2.1 release (security fix)
3. @fastify/busboy npm package
4. CWE-835: Loop with Unreachable Exit Condition
5. FIRST EPSS — Exploit Prediction Scoring System
6. CISA Known Exploited Vulnerabilities Catalog
7. @fastify/busboy GitHub repository