CVE-2026-19484

Name of the Vulnerable Software and Affected Versions @fastify/busboy versions 3.1.0 through 3.2.0

Description A remote unauthenticated attacker can cause a Denial of Service by stalling the Node.js event loop. This occurs when a multipart request is sent with a boundary crafted to exactly 252 bytes. This specific length causes the search needle to become 256 bytes, which truncates the default skip distance to zero in the fixed 256 entry byte array used by the streaming search. Consequently, the search becomes a CPU bound loop, allowing a single small request to occupy one CPU core and deny service to other requests handled by the same process.

Recommendations Upgrade to version 3.2.1.