@fastify/busboy Denial of Service via 252-byte multipart boundary infinite loop

CVE-2026-19484 is an infinite-loop denial-of-service in @fastify/busboy versions 3.1.0 through 3.2.0. The multipart boundary-search algorithm uses a lookup table internally. When an attacker sends a multipart request with a boundary of exactly 252 bytes, the search needle becomes 256 bytes, causing a table index to wrap to zero. This traps the parser in a CPU-bound loop on the Node.js event loop — a single malicious request is enough to hang the entire process. No authentication is required; the parser runs before any application middleware. Any service accepting multipart/form-data via @fastify/multipart, Fastify, or direct @fastify/busboy usage on the affected versions is vulnerable. The fix is in version 3.2.1, released August 12, 2026.

The vendor's HIGH / 7.5 rating is fair but slightly generous. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects unauthenticated network-reachable DoS. However, two factors temper real-world risk: (1) the affected version window is narrow — only two minor versions (3.1.0–3.2.0) are vulnerable, so a large portion of the ~22 million weekly download base still on 2.x or earlier 3.0.x is unaffected; and (2) the impact ceiling is availability loss, not code execution or data breach. We downgrade fractionally to 7.0 to reflect the constrained blast radius while respecting the trivial exploitability.

Sources.

1. GHSA-xjh9-v7x6-24jw — @fastify/busboy DoS via oversized boundary
2. @fastify/busboy v3.2.1 release (security fix)
3. @fastify/busboy npm package
4. CWE-835: Loop with Unreachable Exit Condition
5. FIRST EPSS — Exploit Prediction Scoring System
6. CISA Known Exploited Vulnerabilities Catalog
7. @fastify/busboy GitHub repository

Run this on any host with node and npm installed to check whether the installed @fastify/busboy version is in the vulnerable range. No special privileges required. Example: bash check_busboy_cve_2026_19484.sh /path/to/your/project

#!/usr/bin/env bash
# check_busboy_cve_2026_19484.sh
# Checks whether @fastify/busboy is in the vulnerable range 3.1.0–3.2.0
# Usage: bash check_busboy_cve_2026_19484.sh [project_dir]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"

if [ ! -d "$PROJECT_DIR/node_modules" ]; then
  echo "UNKNOWN — no node_modules found in $PROJECT_DIR. Run npm install first."
  exit 2
fi

PKG_JSON="$PROJECT_DIR/node_modules/@fastify/busboy/package.json"

if [ ! -f "$PKG_JSON" ]; then
  echo "UNKNOWN — @fastify/busboy not found in $PROJECT_DIR/node_modules."
  exit 2
fi

VERSION=$(node -e "console.log(require('$PKG_JSON').version)" 2>/dev/null)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not read version from $PKG_JSON."
  exit 2
fi

# Parse semver
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Vulnerable: >=3.1.0, <3.2.1
if [ "$MAJOR" -eq 3 ]; then
  if [ "$MINOR" -eq 1 ]; then
    echo "VULNERABLE — @fastify/busboy $VERSION is in the affected range (3.1.0–3.2.0). Upgrade to 3.2.1."
    exit 1
  elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -eq 0 ]; then
    echo "VULNERABLE — @fastify/busboy $VERSION is in the affected range (3.1.0–3.2.0). Upgrade to 3.2.1."
    exit 1
  fi
fi

echo "PATCHED — @fastify/busboy $VERSION is not in the vulnerable range."
exit 0