CVE-2026-66730

Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6

Description A denial-of-service issue exists in the multipart body parser. An unauthenticated remote attacker can freeze worker processes at 100% CPU by sending a multipart/form-data request containing a partial closing boundary. This occurs because a missing progress guard in the parser loop causes the http mime parse() function to return 0 bytes consumed without setting done or error flags. Consequently, the calling loop re-invokes the parser on the same buffer indefinitely, exhausting all workers and disabling the server until a manual restart is performed.

Recommendations Update facil.io versions 0.6.0 through 0.7.6 to a version where this issue is resolved.