CVE-2026-18549

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions 5.3.0 through 10.1.0

Description An issue exists in the multipart form-data parser where the plugin clears its internal current-file reference while the underlying stream remains open when the busboy fileSize limit truncates a file part. If an unauthenticated client aborts the connection before sending the terminating boundary, the abort cleanup fails to find the stream to destroy. Consequently, the saveRequestFiles() function never settles, causing the request handler to hang and preventing the cleanup of temporary files written to disk. Repeated exploitation can lead to disk and event-loop exhaustion.

Recommendations Upgrade to version 10.1.1.