CVE-2026-117531

Overview

CVE-2026-117531 affects @fastify/multipart plugin versions 5.3.0 through 10.1.6. A malformed multipart request can cause the plugin to silently destroy the file stream, leaving the request hanging and the connection open. This leads to resource exhaustion and denial of service for applications that use delayed file consumption.

Description

@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.

Impact

Availability is compromised; the server can become unresponsive due to hanging connections. The issue affects any Fastify application that uses the multipart plugin with delayed file handling. Defenders should monitor for unusually long‑lived connections and high resource usage. The vulnerability does not affect confidentiality or integrity.

Remediation

Upgrade @fastify/multipart to version 10.1.7 or later. Verify that the application’s file handling logic does not rely on delayed consumption. Apply any relevant Fastify framework updates that enforce proper stream error propagation.

Risk context

Severity is medium (CVSS 5.9). No EPSS data available. The risk is moderate but can be mitigated quickly by upgrading.

Affected products

• @fastify/multipart