CVE-2026-19474

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions 3.0.0 through 10.1.0

Description An issue exists in the multipart form-data parser where the saveRequestFiles() function can leave temporary files on the disk if a client disconnects while the parser is moving between multipart parts. Because the iterator rejection occurs outside the per-file cleanup path, previously completed files are not removed. An unauthenticated client can exploit this behavior to cause persistent, linear disk consumption, resulting in a denial of service.

Recommendations Upgrade to version 10.1.1.