Hamdaanaliquatil

**Name of the Vulnerable Software and Affected Versions** @fastify/reply-from versions 8.3.1 through 12.6.3 **Description** Internal URL cache keys are constructed by concatenating the destination and source paths without a delimiter. This allows different destination and source pairs to generate identical keys despite resolving to different upstream URLs. Consequently, when `getUpstream()` selects an upstream from request data, a cached URL for one upstream may be reused for a request intended for another, leading to cross-upstream data access and modification. Real-world incidents of elevated activity targeting this issue have been observed. **Recommendations** Upgrade to @fastify/reply-from version 12.6.4. As a temporary workaround, pass `disableCache: true` when registering the plugin.

**Name of the Vulnerable Software and Affected Versions** multer versions 2.0.0-alpha.1 through 2.1.1 multer version 3.0.0-alpha.1 **Description** A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads. **Recommendations** Upgrade to version 2.2.0 for versions 2.0.0-alpha.1 through 2.1.1. Upgrade to version 3.0.0-alpha.2 for version 3.0.0-alpha.1.