Npm · Fastify-Multipart · CVE-2026-19474
**Name of the Vulnerable Software and Affected Versions**
@fastify/multipart versions 3.0.0 through 10.1.0
**Description**
An issue exists in the multipart form-data parser where the `saveRequestFiles()` function can leave temporary files on the disk if a client disconnects while the parser is moving between multipart parts. Because the iterator rejection occurs outside the per-file cleanup path, previously completed files are not removed. An unauthenticated client can exploit this behavior to cause persistent, linear disk consumption, resulting in a denial of service.
**Recommendations**
Upgrade to version 10.1.1.