Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Fifoqueue

#50537of 60,385
5.9Total CVSS
Vulnerabilities · 1
PT-2026-135404
2026-11-02
5.9
CVE-2026-117531
Npm
Fastify-Multipart
An issue exists where the plugin fails to propagate a parser error to the file stream when a request body ends within a file part without a closing boundary, provided the Content-Length is complete, the client does not abort, and no file size limit is exceeded. This causes the plugin to destroy the in-progress file stream without an error. Consequently, handlers performing asynchronous work before consuming the file attach to a stream that never emits an error or end event, leaving the request unresponsive while the connection remains open. An unauthenticated remote client can exploit this by sending repeated malformed uploads to exhaust server resources, leading to a Denial of Service (DoS), a condition where a service is unavailable to its intended users.