CVE-2026-19481

Name of the Vulnerable Software and Affected Versions @fastify/busboy versions 1.0.0 through 3.2.0

Description An unauthenticated denial of service can occur when an attacker submits multipart form-data containing a part header with a name that is a prototype-inherited property, such as proto or constructor. The internal header parser uses a plain JavaScript object to store headers and expects each value to be an array. When a prototype-inherited property is used, it resolves to a non-array value, triggering a TypeError. Depending on the integration, this results in an error event or a synchronous exception that can terminate the Node.js process.

Recommendations Upgrade to version 3.2.1.