CVE-2026-117531

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions 5.3.0 through 10.1.6

Description An issue exists where the plugin fails to propagate a parser error to the file stream when a request body ends within a file part without a closing boundary, provided the Content-Length is complete, the client does not abort, and no file size limit is exceeded. This causes the plugin to destroy the in-progress file stream without an error. Consequently, handlers performing asynchronous work before consuming the file attach to a stream that never emits an error or end event, leaving the request unresponsive while the connection remains open. An unauthenticated remote client can exploit this by sending repeated malformed uploads to exhaust server resources, leading to a Denial of Service (DoS), a condition where a service is unavailable to its intended users.

Recommendations Upgrade to version 10.1.7 or later.